Reporting

export stats value results into their own cells

tve784
Path Finder

So the source ip field in my results can have multiple results in it. Im trying to figure out how to get each one of those results put into their own cell when exporting to excel. with my current output it puts the source ip's in one cell on the bottom. i would like them to be in their own cells in that same column. Also if there is a way to sort the source ip's as well that would be even more awesome.

... | stats values(src_ip) by dest_port, protocol, dest_ip | sort +dest_port, dest_ip | transpose 1000000

Tags (3)
0 Karma

tve784
Path Finder

is there a way to delete this question?

0 Karma

tve784
Path Finder

ok so im just going to can this idea if i can just figure out a way to sort the ip's that are within the "values(src_ip)" then i will be golden.

0 Karma

felipesewaybric
Contributor

try something like | eval ip_something= coalesce(src_ip, dest_port, protocol, dest_ip)

coalesce is what i use on this cases.

http://blogs.splunk.com/2014/03/21/search-command-coalesce/

0 Karma

tve784
Path Finder

I don't think that will do much for what im trying to achieve. looking over the docs that is used to combine fields that arn't named the same into 1 field. All my fields are correct. I just need to output the source ip's one per cell in the csv that im exporting too.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...