Dashboards & Visualizations

search for multiple value fields to multi column table

Engager

title is bit confusing but I have a data like the below

date,assetname,assetIP
2020/05/05 10:00:00,esprbtrapmgr1,195.187.11.144
2020/05/05 10:00:00,nxc-webap2,10.186.36.196
2020/05/05 10:00:00,eytocesxc7p15,10.16.22.186
2020/05/05 10:00:00,eytocesxc7p15,10.16.22.18
2020/05/05 10:00:00,eytocesxc7p15,10.16.26.98
2020/05/05 10:00:00,aktocesxc16p08,10.16.26.21
2020/05/05 10:00:00,aktocesxc16p08,10.16.56.23

and I want a table like
any suggestions ?

assetname| assetIP |assetIP2 |assetIP3    ....
esprbtrapmgr1|195.187.11.144 
eytocesxc7p15 |10.16.22.186|10.16.22.18|10.16.26.98|
aktocesxc16p08|10.16.26.21|10.16.56.23
Labels (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

This brute-force method works, but only with a fixed number of assetIP values.

| makeresults | eval _raw="assetname      assetIP
esprbtrapmgr1  195.187.11.144
nxc-webap2     10.186.36.196
eytocesxc7p15  10.16.22.186
eytocesxc7p15  10.16.22.18
eytocesxc7p15  10.16.26.98
aktocesxc16p08 10.16.26.21
aktocesxc16p08 10.16.56.23" | multikv forceheader=1
`comment("Above just sets test data")`
| stats values(assetIP) as assetIP by assetname
`comment("mvindex(assetIP, 0) must be last")`
| eval assetIP2=mvindex(assetIP, 1), assetIP3=mvindex(assetIP, 2), assetIP=mvindex(assetIP, 0)
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Engager

Thanks that worked 🙂

0 Karma

SplunkTrust
SplunkTrust

This brute-force method works, but only with a fixed number of assetIP values.

| makeresults | eval _raw="assetname      assetIP
esprbtrapmgr1  195.187.11.144
nxc-webap2     10.186.36.196
eytocesxc7p15  10.16.22.186
eytocesxc7p15  10.16.22.18
eytocesxc7p15  10.16.26.98
aktocesxc16p08 10.16.26.21
aktocesxc16p08 10.16.56.23" | multikv forceheader=1
`comment("Above just sets test data")`
| stats values(assetIP) as assetIP by assetname
`comment("mvindex(assetIP, 0) must be last")`
| eval assetIP2=mvindex(assetIP, 1), assetIP3=mvindex(assetIP, 2), assetIP=mvindex(assetIP, 0)
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!