Splunk Search

Create a table with different fields depending if their values match a condition

andres
Loves-to-Learn Lots

I have a raw where each event looks like this (simplified for this exampel):
{"time": "2022-01-20 16:40:02.325216", "name": "name1", "deployment": "found", "secret": "correct"}

If "deployment": "not_found", I would like to have a table like:

timenamedeployment
2022-01-20 16:40:02.325216name1not_found


If "secret": "incorrect", I would like to have a table like:

timenamesecret
2022-01-20 16:40:02.325216name1incorrect

 

Currently, my search looks like this:

 

index=index host=host source=source ("not_found" OR "incorrect")
| table time name deployment secret

 

But this means that both fields (deployment and secret) will be shown no matter what their value is.

@Ayn Is there a way to have a table which varies its fields depending on a certain condition?

Thanks in advance! 

Labels (5)
Tags (3)
0 Karma

somesoni2
Revered Legend

See if something like this works for you.

index=index host=host source=source ("not_found" OR "incorrect")
|  table time name deployment secret
|  eval metric=if(deployment="not found", "deployment", "secret")
|  eval val=if(deployment="not found", "not found", "incorrect") 
|  table time name metric val 
|  eval {metric}=val 
|  fields - metric val
0 Karma

richgalloway
SplunkTrust
SplunkTrust

A table can have only one set of headings.  You can combine two columns into one using coalesce.  For example, this query will create a 3-column table with either deployment or secret in column3.  The trick for the reader, however, is to determine which it is.

index=index host=host source=source ("not_found" OR "incorrect")
| eval column3 = coalesce(deployment, secret)
| rename column3 as "deployment or secret"
| table time name "deployment or secret"

 

---
If this reply helps you, an upvote would be appreciated.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>