Splunk Search

How do you get tabular event with field value pair?

twh1
Communicator

I have an event in the below format.

INCIDENT_ID          PROBLEM_KEY                                                 CREATE_TIME                              
-------------------- ----------------------------------------------------------- ---------------------------------------- 
102753               ORA 15064                                                   2018-05-24 15:38:50.242000 -04:00       
107689               ORA 29740                                                   2018-05-24 17:04:00.414000 -04:00       
112801               ORA 32701                                                   2018-05-24 20:59:14.420000 -04:00 

I need this data as INCIDENT_ID field with values (102753, 107689, 112801), and PROBLEM_KEY, CREATE_TIME fields in same way. I used multikv command, but I am not getting the desired result.

base search | multikv fields INCIDENT_ID PROBLEM_KEY CREATE_TIME | table INCIDENT_ID PROBLEM_KEY CREATE_TIME
0 Karma
1 Solution

twh1
Communicator

I got the desired output by using below command.

base search | multikv | table INCIDENT_ID PROBLEM_KEY CREATE_TIME

View solution in original post

0 Karma

twh1
Communicator

I got the desired output by using below command.

base search | multikv | table INCIDENT_ID PROBLEM_KEY CREATE_TIME
0 Karma

somesoni2
Revered Legend

What's the current output looks like and what should be the expected output?

0 Karma

twh1
Communicator

@somesoni2 :

I need 3 fileds(INCIDENT_ID, PROBLEM_KEY, CREATE_TIME) should get created at run time. When I use table command to print these fields respective column value should come in that field.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@twh1, if its currently displaying as a single row, then try

your search|eval z=mvzip(mvzip( INCIDENT_ID ,PROBLEM_KEY,"," ),CREATE_TIME,"," )|fields z|mvexpand z|eval s=split(z,",")|eval INCIDENT_ID=mvindex(s,0),PROBLEM_KEY=mvindex(s,1),CREATE_TIME=mvindex(s,2)|fields INCIDENT_ID,PROBLEM_KEY,CREATE_TIME
Happy Splunking!
0 Karma

twh1
Communicator

Hi @renjith.nair
I tried above query but didn't get the desired output.

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...