Splunk Search

How to a create a table search for my data?

sravankaripe
Communicator

i have fields key and value

field "key" contains values

sessionID      
txnID              
eventSeverity
msgType       
appID             
envID             

field "value" contains values

mhdshdsjkj87
kjkfdjkjvkfd37
Debug
RESPONSE
MyService
PROD

_________|  table _time key value

-----------------------------------------------

_time              |          key               |       value
------------------------------------------------------------------
 2017-06-03        |   sessionID                |  mhdshdsjkj87
                   |   txnID                    |  kjkfdjkjvkfd37
                   |   eventSeverity            |  Debug
                   |   msgType                  |  RESPONSE
                   |   appID                    |  MyService
                   |   envID                    |  PROD

how can i convert it into

----|table   sessionID      txnID              eventSeverity msgType       appID             envID   

--------------------------------------------------------------------------------------------------------------
sessionID     |     txnID       |  eventSeverity  |  msgType  |    appID      |    envID   
--------------------------------------------------------------------------------------------------------------
mhdshdsjkj87  |  kjkfdjkjvkfd37 |     Debug       | RESPONSE  |  MyService    |    PROD
0 Karma

woodcock
Esteemed Legend

This spoofs the data:

| makeresults 
| eval key="sessionID::txnID::eventSeverity::msgType::appID:: envID"
| eval value="mhdshdsjkj87::kjkfdjkjvkfd37::Debug::RESPONSE::MyService::PROD"
| makemv delim="::" key
| makemv delim="::" value

This is your solution:

| streamstats count AS _serial
| eval kvp=mvzip(key, value, "=")
| fields - key value
| mvexpand kvp
| rex field=kvp "^(?<key_1>[^=]+)=(?<val_1>.*)$"
| eval {key_1} = val_1
| fields - kvp key_1 val_1
| stats first(_time) AS _time values(*) AS * BY _serial
0 Karma

somesoni2
Revered Legend

Assuming in your sample data, _time is available in all rows , try this

your current search giving fields _time key value
| xyseries _time key value
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...