Splunk Search

How to create a field from value of an existing field?

rwiley
Explorer

i have this search

index=cmedia sourcetype="adspecificsnmp" 
 | rex field=_raw mode=sed "s/=,/=NA,/g"
 | rex field=_raw max_match=0 "(?(\d+\.)+)(?\d+)=(?[^,]+)"
 | eval tempString=mvzip(sP, (mvzip (sS, sV, "~")), "~")
 | mvexpand tempString
 | rex field=tempString "(?[^~]+)~(?[^~]+)~(?(.*))"
 | eval myString=stringPrefix."".stringSuffix
 | lookup ACMCodes.csv Suffix as stringSuffix OUTPUT Description as description
 | table description, stringValue

this is partial result. there are 28 values in all

     description,                  stringValue
1   Version ,                   2
2   Box ,                       0
3   Port    ,                      0
4   NodeNumber,                 1
5   PositioinofSpot,               1
6   ScheduleSpotPosition,         1
7   EventPosition,               4
8   FramesPerSec,                 30
9   Owner,                       0

i need the description as a field with value of stringValue

Version ,       Box ,         Port,            NodeNumber,         PositionofSpot,
      2 ,         0 ,           0 ,                    1 ,                     1 ,

i hope this makes sense

0 Karma
1 Solution

Flynt
Splunk Employee
Splunk Employee

A bit shoestringed here but what if you try

|chart list(stringValue)  over stringValue by description|stats list(*) as *|fields - stringValue

For example in the following test search -

|stats count|fields - count|eval description="Version ,", stringValue="2"|append [|stats count|fields - count|eval description="Box ,", stringValue="0"]|chart list(stringValue)  over stringValue by description|stats list(*) as *|fields - stringValue

Version and Box should show up in the same row.

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi rwiley,
did you tried with the transpose command?
Bye.
Giuseppe

0 Karma

Flynt
Splunk Employee
Splunk Employee

A bit shoestringed here but what if you try

|chart list(stringValue)  over stringValue by description|stats list(*) as *|fields - stringValue

For example in the following test search -

|stats count|fields - count|eval description="Version ,", stringValue="2"|append [|stats count|fields - count|eval description="Box ,", stringValue="0"]|chart list(stringValue)  over stringValue by description|stats list(*) as *|fields - stringValue

Version and Box should show up in the same row.

0 Karma

rwiley
Explorer

thanks Flynt! just what i needed. sorry to take so long on reply. got pulled to another project.

0 Karma

gokadroid
Motivator

How about you try |eval {description,}=stringValue right at the end which will create a field name for each description, which it sees and then tabulate that using | table (*,)
Explanation here for the eval expression above

 index=cmedia sourcetype="adspecificsnmp" 
  | rex field=_raw mode=sed "s/=,/=NA,/g"
  | rex field=_raw max_match=0 "(?(\d+\.)+)(?\d+)=(?[^,]+)"
  | eval tempString=mvzip(sP, (mvzip (sS, sV, "~")), "~")
  | mvexpand tempString
  | rex field=tempString "(?[^~]+)~(?[^~]+)~(?(.*))"
  | eval myString=stringPrefix."".stringSuffix
  | lookup ACMCodes.csv Suffix as stringSuffix OUTPUT Description as description
  | eval {description,}=stringValue
  | table (*,)
0 Karma

rwiley
Explorer

This works. but it doesn't bring it in in one row. it brings in the value for stringValue but the rest of the row is empty.

example:
Date SpotID Zone Channel
1 date

2 478393
3 CNN
4 zone

i was hoping to get this
Date SpotID Zone Channel
1 date 478393 zone CNN

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...