Splunk Search

Create a table with different fields depending if their values match a condition

andres
Loves-to-Learn Lots

I have a raw where each event looks like this (simplified for this exampel):
{"time": "2022-01-20 16:40:02.325216", "name": "name1", "deployment": "found", "secret": "correct"}

If "deployment": "not_found", I would like to have a table like:

timenamedeployment
2022-01-20 16:40:02.325216name1not_found


If "secret": "incorrect", I would like to have a table like:

timenamesecret
2022-01-20 16:40:02.325216name1incorrect

 

Currently, my search looks like this:

 

index=index host=host source=source ("not_found" OR "incorrect")
| table time name deployment secret

 

But this means that both fields (deployment and secret) will be shown no matter what their value is.

@Ayn Is there a way to have a table which varies its fields depending on a certain condition?

Thanks in advance! 

Labels (5)
Tags (3)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

See if something like this works for you.

index=index host=host source=source ("not_found" OR "incorrect")
|  table time name deployment secret
|  eval metric=if(deployment="not found", "deployment", "secret")
|  eval val=if(deployment="not found", "not found", "incorrect") 
|  table time name metric val 
|  eval {metric}=val 
|  fields - metric val
0 Karma

richgalloway
SplunkTrust
SplunkTrust

A table can have only one set of headings.  You can combine two columns into one using coalesce.  For example, this query will create a 3-column table with either deployment or secret in column3.  The trick for the reader, however, is to determine which it is.

index=index host=host source=source ("not_found" OR "incorrect")
| eval column3 = coalesce(deployment, secret)
| rename column3 as "deployment or secret"
| table time name "deployment or secret"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...