Splunk Search

How do you get tabular event with field value pair?

twh1
Communicator

I have an event in the below format.

INCIDENT_ID          PROBLEM_KEY                                                 CREATE_TIME                              
-------------------- ----------------------------------------------------------- ---------------------------------------- 
102753               ORA 15064                                                   2018-05-24 15:38:50.242000 -04:00       
107689               ORA 29740                                                   2018-05-24 17:04:00.414000 -04:00       
112801               ORA 32701                                                   2018-05-24 20:59:14.420000 -04:00 

I need this data as INCIDENT_ID field with values (102753, 107689, 112801), and PROBLEM_KEY, CREATE_TIME fields in same way. I used multikv command, but I am not getting the desired result.

base search | multikv fields INCIDENT_ID PROBLEM_KEY CREATE_TIME | table INCIDENT_ID PROBLEM_KEY CREATE_TIME
0 Karma
1 Solution

twh1
Communicator

I got the desired output by using below command.

base search | multikv | table INCIDENT_ID PROBLEM_KEY CREATE_TIME

View solution in original post

0 Karma

twh1
Communicator

I got the desired output by using below command.

base search | multikv | table INCIDENT_ID PROBLEM_KEY CREATE_TIME
0 Karma

somesoni2
SplunkTrust
SplunkTrust

What's the current output looks like and what should be the expected output?

0 Karma

twh1
Communicator

@somesoni2 :

I need 3 fileds(INCIDENT_ID, PROBLEM_KEY, CREATE_TIME) should get created at run time. When I use table command to print these fields respective column value should come in that field.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@twh1, if its currently displaying as a single row, then try

your search|eval z=mvzip(mvzip( INCIDENT_ID ,PROBLEM_KEY,"," ),CREATE_TIME,"," )|fields z|mvexpand z|eval s=split(z,",")|eval INCIDENT_ID=mvindex(s,0),PROBLEM_KEY=mvindex(s,1),CREATE_TIME=mvindex(s,2)|fields INCIDENT_ID,PROBLEM_KEY,CREATE_TIME
Happy Splunking!
0 Karma

twh1
Communicator

Hi @renjith.nair
I tried above query but didn't get the desired output.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...