Splunk Search

How do I covert an Object name into columns using a back slash?

shishirkumar
Engager

Hello Team,

Could anyone help me in spiting an Object name into a column name?

Like In Query we are getting Object name as in One Column :

R:\ClientReports\OpenCaseReport\DataFiles\AmeriHealth_Open\CaseReport_20101210.txt

I wanted to spit that into 6 columns as A ,B,C,D,E,F

The output would be like this

Header table : A |B|C|D|E|F
Row Data : R: |ClientReports|OpenCaseReport|DataFiles|AmeriHealthOpen|CaseReportt_20101210.txt

0 Karma

Vijeta
Influencer

The below query should help you , you can also rename row1, row2 etc. accordingly and display the columns and row that you want using where

  • |makeresults|eval x="R:\ClientReports\OpenCaseReport\DataFiles\AmeriHealth_Open\CaseReport_20101210.txt"| makemv delim="\" x|mvexpand x| transpose
0 Karma

shishirkumar
Engager

it not working if i am remove hardcoded value that is "R:\ClientReports\OpenCaseReport\DataFiles\AmeriHealth_Open\CaseReport_20101210.txt" with my column name ?

Could You please help to resolve that.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...