Splunk Search

How do I covert an Object name into columns using a back slash?

shishirkumar
Engager

Hello Team,

Could anyone help me in spiting an Object name into a column name?

Like In Query we are getting Object name as in One Column :

R:\ClientReports\OpenCaseReport\DataFiles\AmeriHealth_Open\CaseReport_20101210.txt

I wanted to spit that into 6 columns as A ,B,C,D,E,F

The output would be like this

Header table : A |B|C|D|E|F
Row Data : R: |ClientReports|OpenCaseReport|DataFiles|AmeriHealthOpen|CaseReportt_20101210.txt

0 Karma

Vijeta
Influencer

The below query should help you , you can also rename row1, row2 etc. accordingly and display the columns and row that you want using where

  • |makeresults|eval x="R:\ClientReports\OpenCaseReport\DataFiles\AmeriHealth_Open\CaseReport_20101210.txt"| makemv delim="\" x|mvexpand x| transpose
0 Karma

shishirkumar
Engager

it not working if i am remove hardcoded value that is "R:\ClientReports\OpenCaseReport\DataFiles\AmeriHealth_Open\CaseReport_20101210.txt" with my column name ?

Could You please help to resolve that.

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...