I need to pivot only certain fields in a set of logs. Sample data below. Can you tell me how to go about doing this?
**Sample Data**
_time Id Server DetailId Name Value
5/15/18 11:00 1 Server1 1 Name1 Value1
5/15/18 11:00 1 Server1 2 Name2 Value2
5/15/18 11:00 1 Server1 3 Name3 Value3
5/15/18 11:01 2 Server1 4 Name1 Value4
5/15/18 11:01 2 Server1 5 Name2 Value5
5/15/18 11:01 2 Server1 6 Name3 Value6
**Desired Results**
_time Id Server Name1 Name2 Name3
5/15/18 11:00 1 Server1 Value1 Value2 Value3
5/15/18 11:01 2 Server1 Value4 Value5 Value6
@bschaap, based on the sample data provided try the following run anywhere search.
PS: query from |makeresults
till | fields - data
generate dummy data as per the question.
| makeresults
| eval data="5/15/18 11:00,1,Server1,1,Name1,Value1;5/15/18 11:00,1,Server1,2,Name2,Value2;5/15/18 11:00,1,Server1,3,Name3,Value3;5/15/18 11:01,2,Server1,4,Name1,Value4;5/15/18 11:01,2,Server1,5,Name2,Value5;5/15/18 11:01,2,Server1,6,Name3,Value6"
| makemv data delim=";"
| mvexpand data
| makemv data delim=","
| eval _time=mvindex(data,0),Id=mvindex(data,1),Server=mvindex(data,2),DetailId=mvindex(data,3),Name=mvindex(data,4),Value=mvindex(data,5)
| fields - data
| eval key= _time."-".Id."-".Server
| chart values(Value) by key Name
| makemv key delim="-"
| eval _time=mvindex(key,0), Id=mvindex(key,1), Server=mvindex(key,2)
| table _time Id Server Name*
@bschaap, based on the sample data provided try the following run anywhere search.
PS: query from |makeresults
till | fields - data
generate dummy data as per the question.
| makeresults
| eval data="5/15/18 11:00,1,Server1,1,Name1,Value1;5/15/18 11:00,1,Server1,2,Name2,Value2;5/15/18 11:00,1,Server1,3,Name3,Value3;5/15/18 11:01,2,Server1,4,Name1,Value4;5/15/18 11:01,2,Server1,5,Name2,Value5;5/15/18 11:01,2,Server1,6,Name3,Value6"
| makemv data delim=";"
| mvexpand data
| makemv data delim=","
| eval _time=mvindex(data,0),Id=mvindex(data,1),Server=mvindex(data,2),DetailId=mvindex(data,3),Name=mvindex(data,4),Value=mvindex(data,5)
| fields - data
| eval key= _time."-".Id."-".Server
| chart values(Value) by key Name
| makemv key delim="-"
| eval _time=mvindex(key,0), Id=mvindex(key,1), Server=mvindex(key,2)
| table _time Id Server Name*
Thank you. My actual data has about 50 different name / value pairs and Splunk is placing most of these in an OTHER column. I then used the limit=0 chart option to display all fields.