Splunk Search

Can you help me create a table like the one in the following example?

syjayaraj
Explorer

Dear Team,

I have data in this format, as shown in actual and expecting results as shown in expected. Is this achievable? May i request your heIp?

alt text

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@syjayaraj

Can you please try this?

YOUR_SEARCH
| table Label Value OID | chart values(Value) as Value over OID by Label

Sample Search:

|makeresults | eval data="Admin Status|2|505,SSH|2|505,Serial Number|FYUUU5|505,Admin Status|2|506,SSH|2|506,Serial Number|FYUUU6|506" | eval data =split(data,",") | mvexpand data | eval Label=mvindex(split(data,"|"),0),Value=mvindex(split(data,"|"),1),OID=mvindex(split(data,"|"),2) | table Label Value OID | chart values(Value) as Value over OID by Label

Thanks

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@syjayaraj

Have you tried this?

0 Karma

harishalipaka
Motivator

hi @syjayaraj

try below,it is helped pls accept answer 🙂

|makeresults |eval Label="Admin status" ,Value=2,OID=505 |append [|makeresults |eval Label="SSH" ,Value=2,OID=505]|append [|makeresults |eval Label="Serial number" ,Value="FYUUU5",OID=505]|append [|makeresults |eval Label="Admin status" ,Value=2,OID=506]|append [|makeresults |eval Label="SSH" ,Value=1,OID=506]|append [|makeresults |eval Label="Serial number" ,Value="FYUUU6",OID=506] |table Label Value OID |chart values(Value) over OID by Label
Thanks
Harish
0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...