How do you transform table values like this?

[splunkelz]

Is there a way or command to make the table results something like on the expected output.

current data:

hostname	ip	database_status	internet_status	proxy_status
server101	192.168.10.2	online	online	offline
server102	192.168.10.3	offline	online	offline

expected output:

hostname	ip	status
server101	192.168.10.2	database_status = "online" internet_status = "online" proxy_status = "offline"
server102	192.168.10.3	database_status = "offline" internet_status = "online" proxy_status = "offline"

[splunkelz]

Thanks @kamlesh_vaghela

[gcusello]

Hi @splunkelz,

please try something like this:

index=your_index
| eval 
     database_status="database_status=".database_status,
     internet_status="internet_status".internet_status,
     proxy_status="proxy_status".proxy_status
| stats values(ip) AS ip values(database_status) AS database_status values(internet_status) AS internet_status values(proxy_status) AS proxy_status BY hostname

Ciao.

Giuseppe

[kamlesh_vaghela · Accepted solution]

@splunkelz 

Can you please try this?

YOUR_SEARCH
| eval status=""
| foreach *_status 
    [| eval status= mvappend(status,"<<FIELD>>"+"="+<<FIELD>>)] 
| table hostname ip status

My Sample Search :

| makeresults 
| eval _raw="hostname	ip	database_status	internet_status	proxy_status
server101	192.168.10.2	online	online	offline
server102	192.168.10.3	offline	online	offline" 
| multikv forceheader=1 
| table hostname ip database_status internet_status proxy_status 
| eval status=""
| foreach *_status 
    [| eval status= mvappend(status,"<<FIELD>>"+"="+<<FIELD>>)] 
| table hostname ip status

Thanks
KV
 

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.