Splunk Enterprise

how to get string values into column values dynamically

shivareddysompa
Explorer

hi,

i have data like below. i want to string into column values then need to join with my query.

System                   effected Region

a:b:c;d;e;f                  India

i need like below.

system                     effected Region

a                               India

b                               India

c                               India

d                               India

e                                India

f                                 India

 

Thanks in advance

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
| makeresults | eval _raw="System     effected_Region
a:b:c;d;e;f  India" | multikv forceheader=1
`comment("Above just sets up test data")`
| eval System=split(System,":") | mvexpand System 
| eval System=split(System,";") | mvexpand System

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust
| makeresults | eval _raw="System     effected_Region
a:b:c;d;e;f  India" | multikv forceheader=1
`comment("Above just sets up test data")`
| eval System=split(System,":") | mvexpand System 
| eval System=split(System,";") | mvexpand System

 

---
If this reply helps you, Karma would be appreciated.
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Introducing .conf Stories Series!

“.conf Stories” Series – First Feature: Rich Mahlerwein   Every year .conf brings together some of the most ...