Splunk Search

Append fields to table after using xyseries.

anooshac
Communicator

This question is related my previous post.

https://community.splunk.com/t5/Splunk-Search/XML-field-Extraction/m-p/571944#M199301

My source have a date which i'll be extracting using rex command. I want my table data to be shown on those respective dates. I have used xyseries, but i cannot add other fields to the table.

source="weekly_report_20211025_160957*.xml"  |rex field=source "weekly_report_(?<Date>\w.*)\.xml"|....

| table suitename  name "Time taken(s)" status  | xyseries name Date status

My final table should contain suitename , name, "Time taken(s)", status(under the Date filed).

Is there any method to append all these table fields after applying xyseries?

Labels (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Just add any other field that you want to add to output, to eval (to merge), rex (to extract is again) and table command (to display). Like this:

source="weekly_report_20211025_160957*.xml"  |rex field=source "weekly_report_(?<Date>\w.*)\.xml"|...
| table suitename  name "Time taken(s)" status Date
| eval temp=suitename."###".name.'Time taken(s)'
| xyseries temp Date status
| rex field=temp "(?<suitename>[^\#]+)###(?<name>[^\#]+)###(?<Time>.+)" | fields - temp
| table suitename name Time *
| rename Time as "Time taken(s)"

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Just add any other field that you want to add to output, to eval (to merge), rex (to extract is again) and table command (to display). Like this:

source="weekly_report_20211025_160957*.xml"  |rex field=source "weekly_report_(?<Date>\w.*)\.xml"|...
| table suitename  name "Time taken(s)" status Date
| eval temp=suitename."###".name.'Time taken(s)'
| xyseries temp Date status
| rex field=temp "(?<suitename>[^\#]+)###(?<name>[^\#]+)###(?<Time>.+)" | fields - temp
| table suitename name Time *
| rename Time as "Time taken(s)"
0 Karma

anooshac
Communicator

yes.. I got them.. Once again thank you so much for the help!!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this:

source="weekly_report_20211025_160957*.xml"  |rex field=source "weekly_report_(?<Date>\w.*)\.xml"|...
| table suitename  name "Time taken(s)" status  
| eval temp=suitename."###".name
| xyseries temp Date status
| rex field=temp "(?<suitename>[^\#]+)###(?<name>.+)" | fields - temp
| table suitename name *
0 Karma

anooshac
Communicator

Wow!! Thank you.. It is working perfectly...

Is there any way to add one field, ie "Time taken(s)"?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...