Splunk Search

How do you get tabular event with field value pair?

twh1
Communicator

I have an event in the below format.

INCIDENT_ID          PROBLEM_KEY                                                 CREATE_TIME                              
-------------------- ----------------------------------------------------------- ---------------------------------------- 
102753               ORA 15064                                                   2018-05-24 15:38:50.242000 -04:00       
107689               ORA 29740                                                   2018-05-24 17:04:00.414000 -04:00       
112801               ORA 32701                                                   2018-05-24 20:59:14.420000 -04:00 

I need this data as INCIDENT_ID field with values (102753, 107689, 112801), and PROBLEM_KEY, CREATE_TIME fields in same way. I used multikv command, but I am not getting the desired result.

base search | multikv fields INCIDENT_ID PROBLEM_KEY CREATE_TIME | table INCIDENT_ID PROBLEM_KEY CREATE_TIME
0 Karma
1 Solution

twh1
Communicator

I got the desired output by using below command.

base search | multikv | table INCIDENT_ID PROBLEM_KEY CREATE_TIME

View solution in original post

0 Karma

twh1
Communicator

I got the desired output by using below command.

base search | multikv | table INCIDENT_ID PROBLEM_KEY CREATE_TIME
0 Karma

somesoni2
Revered Legend

What's the current output looks like and what should be the expected output?

0 Karma

twh1
Communicator

@somesoni2 :

I need 3 fileds(INCIDENT_ID, PROBLEM_KEY, CREATE_TIME) should get created at run time. When I use table command to print these fields respective column value should come in that field.

0 Karma

renjith_nair
Legend

@twh1, if its currently displaying as a single row, then try

your search|eval z=mvzip(mvzip( INCIDENT_ID ,PROBLEM_KEY,"," ),CREATE_TIME,"," )|fields z|mvexpand z|eval s=split(z,",")|eval INCIDENT_ID=mvindex(s,0),PROBLEM_KEY=mvindex(s,1),CREATE_TIME=mvindex(s,2)|fields INCIDENT_ID,PROBLEM_KEY,CREATE_TIME
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

twh1
Communicator

Hi @renjith.nair
I tried above query but didn't get the desired output.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...