Reporting

export stats value results into their own cells

Path Finder

So the source ip field in my results can have multiple results in it. Im trying to figure out how to get each one of those results put into their own cell when exporting to excel. with my current output it puts the source ip's in one cell on the bottom. i would like them to be in their own cells in that same column. Also if there is a way to sort the source ip's as well that would be even more awesome.

... | stats values(src_ip) by dest_port, protocol, dest_ip | sort +dest_port, dest_ip | transpose 1000000

Tags (3)
0 Karma

Path Finder

is there a way to delete this question?

0 Karma

Path Finder

ok so im just going to can this idea if i can just figure out a way to sort the ip's that are within the "values(src_ip)" then i will be golden.

0 Karma

Contributor

try something like | eval ip_something= coalesce(src_ip, dest_port, protocol, dest_ip)

coalesce is what i use on this cases.

http://blogs.splunk.com/2014/03/21/search-command-coalesce/

0 Karma

Path Finder

I don't think that will do much for what im trying to achieve. looking over the docs that is used to combine fields that arn't named the same into 1 field. All my fields are correct. I just need to output the source ip's one per cell in the csv that im exporting too.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!