Dashboards & Visualizations

depends on one of the filed(type) value, re-name fields and create table

Pragnesh
Loves-to-Learn

here is log format:

Type=0 name=aaa1 door=aaa2 street=aaa3 city=aaa4 country=aaa5 dr="" CN=""
Type=0 name=bbb1 door=bbb2 street=bbb3 city=bbb4 country=bbb5 dr="" CN=""
Type=1 name=ccc1 door="" street=ccc3 city=ccc4 country="" dr=ccc2 CN=ccc5
Type=1 name=ddd1 door="" street=ddd3 city=ddd4 country="" dr=ddd2 CN=ddd5

wanted to create table like below:

NAMEDOOR-NUMBERSTREETCITYCOUNTRY-NAME
aaa1aaa2aaa3aaa4aaa5
bbb1bbb2bbb3bbb4bbb5
ccc1ccc2ccc3ccc4ccc5
ddd1ddd2ddd3ddd4ddd5

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="Type=0 name=aaa1 door=aaa2 street=aaa3 city=aaa4 country=aaa5 dr=\"\" CN=\"\"
Type=0 name=bbb1 door=bbb2 street=bbb3 city=bbb4 country=bbb5 dr=\"\" CN=\"\"
Type=1 name=ccc1 door=\"\" street=ccc3 city=ccc4 country=\"\" dr=ccc2 CN=ccc5
Type=1 name=ddd1 door=\"\" street=ddd3 city=ddd4 country=\"\" dr=ddd2 CN=ddd5"
| multikv noheader=t
| table _raw



| extract pairdelim=" " kvdelim="="
| eval country=if(country="",CN,country)
| eval door=if(door="",dr,door)
| table name door street city country
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...