Dashboards & Visualizations

How to separate rows from a table ?

cleal
New Member

Hi

I´m new in splunk , I´m triying to build an table with this querie :

host="xxxx-pronto" | spath | rename logs{}.request.context.conversation_id AS id_Conversacion,logs{}.request.input.text AS Pregunta,logs{}.response.output.text{} AS Respuesta,logs{}.response_timestamp AS Fecha_Respuesta,logs{}.response.intents{}.intent AS Intencion | table id_Conversacion,Pregunta,Respuesta,Fecha_Respuesta,Intencion

alt text
But only i´m getting all results in a event .How can i separate all results in separate rows.

Thanks

Tags (1)
0 Karma

niketn
Legend

@cleal you should consider configuration for event line breaking within JSON data to separate events while indexing. (you seem to have timestamp for each row of multi-value events, which is good for extracting event timestamp). This would imply more time in indexing the data (possibly though Heavy Forwarder, if you do not want to load the indexers). However, this would also imply less load during search time while processing multi-value fields.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

kmaron
Motivator

I had a similar issue here: https://answers.splunk.com/answers/623015/question-involving-breaking-out-multiple-multivalu.html

Maybe that answer can help you as well.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...