Splunk Search

fieldformat individually is a pain

NickJLange
Explorer

Related to my previous question on arbitrary lists of variables...

sum(CPU*) seems to pull off an interesting trick of
1.) enumerating all possible variables starting with CPU

Is there anyway to template their output name sum(CPU*) as CPU$BLAH$

which then leads to any way to do this en-masse for fieldformat?

right now I'm using excel to generate the field list... which is slightly complex and painful. Would love something simple/elegant...

0 Karma

sundareshr
Legend

You could try this

| stats sum(CPU*) AS CPU* | foreach CPU* [ eval <<FIELD>>= tostring(<<FIELD>>, "commas") ]
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...