Splunk Search

Append fields to table after using xyseries.

anooshac
Communicator

This question is related my previous post.

https://community.splunk.com/t5/Splunk-Search/XML-field-Extraction/m-p/571944#M199301

My source have a date which i'll be extracting using rex command. I want my table data to be shown on those respective dates. I have used xyseries, but i cannot add other fields to the table.

source="weekly_report_20211025_160957*.xml"  |rex field=source "weekly_report_(?<Date>\w.*)\.xml"|....

| table suitename  name "Time taken(s)" status  | xyseries name Date status

My final table should contain suitename , name, "Time taken(s)", status(under the Date filed).

Is there any method to append all these table fields after applying xyseries?

Labels (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Just add any other field that you want to add to output, to eval (to merge), rex (to extract is again) and table command (to display). Like this:

source="weekly_report_20211025_160957*.xml"  |rex field=source "weekly_report_(?<Date>\w.*)\.xml"|...
| table suitename  name "Time taken(s)" status Date
| eval temp=suitename."###".name.'Time taken(s)'
| xyseries temp Date status
| rex field=temp "(?<suitename>[^\#]+)###(?<name>[^\#]+)###(?<Time>.+)" | fields - temp
| table suitename name Time *
| rename Time as "Time taken(s)"

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Just add any other field that you want to add to output, to eval (to merge), rex (to extract is again) and table command (to display). Like this:

source="weekly_report_20211025_160957*.xml"  |rex field=source "weekly_report_(?<Date>\w.*)\.xml"|...
| table suitename  name "Time taken(s)" status Date
| eval temp=suitename."###".name.'Time taken(s)'
| xyseries temp Date status
| rex field=temp "(?<suitename>[^\#]+)###(?<name>[^\#]+)###(?<Time>.+)" | fields - temp
| table suitename name Time *
| rename Time as "Time taken(s)"
0 Karma

anooshac
Communicator

yes.. I got them.. Once again thank you so much for the help!!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this:

source="weekly_report_20211025_160957*.xml"  |rex field=source "weekly_report_(?<Date>\w.*)\.xml"|...
| table suitename  name "Time taken(s)" status  
| eval temp=suitename."###".name
| xyseries temp Date status
| rex field=temp "(?<suitename>[^\#]+)###(?<name>.+)" | fields - temp
| table suitename name *
0 Karma

anooshac
Communicator

Wow!! Thank you.. It is working perfectly...

Is there any way to add one field, ie "Time taken(s)"?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...