Splunk Search

Append fields to table after using xyseries.

anooshac
Communicator

This question is related my previous post.

https://community.splunk.com/t5/Splunk-Search/XML-field-Extraction/m-p/571944#M199301

My source have a date which i'll be extracting using rex command. I want my table data to be shown on those respective dates. I have used xyseries, but i cannot add other fields to the table.

source="weekly_report_20211025_160957*.xml"  |rex field=source "weekly_report_(?<Date>\w.*)\.xml"|....

| table suitename  name "Time taken(s)" status  | xyseries name Date status

My final table should contain suitename , name, "Time taken(s)", status(under the Date filed).

Is there any method to append all these table fields after applying xyseries?

Labels (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Just add any other field that you want to add to output, to eval (to merge), rex (to extract is again) and table command (to display). Like this:

source="weekly_report_20211025_160957*.xml"  |rex field=source "weekly_report_(?<Date>\w.*)\.xml"|...
| table suitename  name "Time taken(s)" status Date
| eval temp=suitename."###".name.'Time taken(s)'
| xyseries temp Date status
| rex field=temp "(?<suitename>[^\#]+)###(?<name>[^\#]+)###(?<Time>.+)" | fields - temp
| table suitename name Time *
| rename Time as "Time taken(s)"

View solution in original post

0 Karma

somesoni2
Revered Legend

Just add any other field that you want to add to output, to eval (to merge), rex (to extract is again) and table command (to display). Like this:

source="weekly_report_20211025_160957*.xml"  |rex field=source "weekly_report_(?<Date>\w.*)\.xml"|...
| table suitename  name "Time taken(s)" status Date
| eval temp=suitename."###".name.'Time taken(s)'
| xyseries temp Date status
| rex field=temp "(?<suitename>[^\#]+)###(?<name>[^\#]+)###(?<Time>.+)" | fields - temp
| table suitename name Time *
| rename Time as "Time taken(s)"
0 Karma

anooshac
Communicator

yes.. I got them.. Once again thank you so much for the help!!

0 Karma

somesoni2
Revered Legend

Try like this:

source="weekly_report_20211025_160957*.xml"  |rex field=source "weekly_report_(?<Date>\w.*)\.xml"|...
| table suitename  name "Time taken(s)" status  
| eval temp=suitename."###".name
| xyseries temp Date status
| rex field=temp "(?<suitename>[^\#]+)###(?<name>.+)" | fields - temp
| table suitename name *
0 Karma

anooshac
Communicator

Wow!! Thank you.. It is working perfectly...

Is there any way to add one field, ie "Time taken(s)"?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...