Hi, splunkres! I have a search that returns several text fields and I would like to form a table with predefined rows and columns, how can I do this?
Here is an example from my research:
index=search
timeformat="%d-%m-%YT%H:%M:%S" earliest="26-10-2021T00:00:00" latest="26-10-2021T23:59:00"
| rex field=search "VPN-ANTIVIRUS-WIN:Mandatory:(?<campo1>.*?):"
| rex field=search ";VPN-ANTIVIRUS-RUN-WIN:Audit:(?<campo2>.*?):"
Format of the table I want to return:
Título | Campo | Status |
linha1 | titulo do campo | campo1 |
linha2 | titulo do campo | campo2 |
And this way I can put as many lines as I want
Does this give what you need?
| table Título Campo Status
It doesn't give me what I want. I want a table with defined rows, because I want the fields one in each row.
How about this?
| table Título Campo Status
| transpose 0
This doesn't work, I believe I have to loop it through all the lines, but I can't find it
Can you share examples of the events you are working with and explain which part of the event should go into which part of the resulting table?