Splunk Search

Create a table with different fields depending if their values match a condition

Loves-to-Learn Lots

I have a raw where each event looks like this (simplified for this exampel):
{"time": "2022-01-20 16:40:02.325216", "name": "name1", "deployment": "found", "secret": "correct"}

If "deployment": "not_found", I would like to have a table like:

2022-01-20 16:40:02.325216name1not_found

If "secret": "incorrect", I would like to have a table like:

2022-01-20 16:40:02.325216name1incorrect


Currently, my search looks like this:


index=index host=host source=source ("not_found" OR "incorrect")
| table time name deployment secret


But this means that both fields (deployment and secret) will be shown no matter what their value is.

@Ayn Is there a way to have a table which varies its fields depending on a certain condition?

Thanks in advance! 

Labels (5)
Tags (3)
0 Karma

Revered Legend

See if something like this works for you.

index=index host=host source=source ("not_found" OR "incorrect")
|  table time name deployment secret
|  eval metric=if(deployment="not found", "deployment", "secret")
|  eval val=if(deployment="not found", "not found", "incorrect") 
|  table time name metric val 
|  eval {metric}=val 
|  fields - metric val
0 Karma


A table can have only one set of headings.  You can combine two columns into one using coalesce.  For example, this query will create a 3-column table with either deployment or secret in column3.  The trick for the reader, however, is to determine which it is.

index=index host=host source=source ("not_found" OR "incorrect")
| eval column3 = coalesce(deployment, secret)
| rename column3 as "deployment or secret"
| table time name "deployment or secret"


If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...