Splunk Search

How make a table with key and value columns and change a field's name?

momori
Explorer

The table we want to make looks something like this:

---------- key | value --------

someName | someValue

someName1 | someValue1

where someName is a field name and someValue is a value of the field we got from our log file.
We're not sure if there is a way to insert a someName text into the table to display. Is this possible?

Tags (3)
0 Karma
1 Solution

mataharry
Communicator

If you want to add a line with a fake events do
` | table key value | append [ |stats count | eval key="someName" | eval value="someValue" | table key value ] | sort -key

if this is just a presentation request.
try

<mysearch> | stats values(myfield) by myotherfield

or it you already have your data , try to rotate it.
<mysearch> | table key value | transpose

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Transpose

View solution in original post

somesoni2
Revered Legend

If my understanding is correct, are you trying to get all the field names and corresponding value(s) from your log? If yes, you can use command called "fieldsummary" which will give you list of fields in your log. Check this out

http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Fieldsummary

0 Karma

ppablo
Retired

Hi @momori

If someName is already a field name in your events from your search, you might find the rename command useful. Have you tried this option yet?

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Rename

ppablo
Retired

No problem @momori 🙂 glad our combined responses helped solve your issue!

Patrick

0 Karma

momori
Explorer

using rename in conjunction with the tranpose from the above answer worked well. Thank you for your help

mataharry
Communicator

If you want to add a line with a fake events do
` | table key value | append [ |stats count | eval key="someName" | eval value="someValue" | table key value ] | sort -key

if this is just a presentation request.
try

<mysearch> | stats values(myfield) by myotherfield

or it you already have your data , try to rotate it.
<mysearch> | table key value | transpose

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Transpose

momori
Explorer

transpose worked. thanks!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...