Splunk Search

Can you help me create a table like the one in the following example?

syjayaraj
Explorer

Dear Team,

I have data in this format, as shown in actual and expecting results as shown in expected. Is this achievable? May i request your heIp?

alt text

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@syjayaraj

Can you please try this?

YOUR_SEARCH
| table Label Value OID | chart values(Value) as Value over OID by Label

Sample Search:

|makeresults | eval data="Admin Status|2|505,SSH|2|505,Serial Number|FYUUU5|505,Admin Status|2|506,SSH|2|506,Serial Number|FYUUU6|506" | eval data =split(data,",") | mvexpand data | eval Label=mvindex(split(data,"|"),0),Value=mvindex(split(data,"|"),1),OID=mvindex(split(data,"|"),2) | table Label Value OID | chart values(Value) as Value over OID by Label

Thanks

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@syjayaraj

Have you tried this?

0 Karma

harishalipaka
Motivator

hi @syjayaraj

try below,it is helped pls accept answer 🙂

|makeresults |eval Label="Admin status" ,Value=2,OID=505 |append [|makeresults |eval Label="SSH" ,Value=2,OID=505]|append [|makeresults |eval Label="Serial number" ,Value="FYUUU5",OID=505]|append [|makeresults |eval Label="Admin status" ,Value=2,OID=506]|append [|makeresults |eval Label="SSH" ,Value=1,OID=506]|append [|makeresults |eval Label="Serial number" ,Value="FYUUU6",OID=506] |table Label Value OID |chart values(Value) over OID by Label
Thanks
Harish
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...