Splunk will create fields dynamically using the eval command. You may also pair the eval command with an if condition. Take this for example:
sourcetype="answers-1372957739" | eval head_key_value_for_1=if(login_id=="1",head_key_value,"NULL")
However, that is highly inefficient because you’d have to hard-code each one of the possible values for the login_id into a giant expression.
The solution here is to create the fields dynamically, based on the data in the message. There is a bit magic to make this happen cleanly. Here is the process:
Group the desired data values in head_key_value by the login_id
sourcetype="answers-1372957739" | stats list(head_key_value) AS head_key_value by login_id
Dynamically create the field that will identify the desired head_key_value with the corresponding login_id:
| eval header="head_key_value_for_".login_id
Remove the unnecessary data to match the report exactly as described in this question:
| fields - login_id
Tranform the tabular data, where the new head_key_value_for_{no} header is the column and the associated value are the values for the head_key_value
| eval no_op=" " | xyseries no_op header head_key_value | fields - no_op
All together you will get something like this:
sourcetype="answers-1372957739"
| stats list(head_key_value) AS head_key_value by login_id
| eval header="head_key_value_for_".login_id
| fields - login_id
| eval no_op=" "
| xyseries no_op header head_key_value
| fields - no_op
I hope this is what you were trying to accomplish.
--gc
Splunk will create fields dynamically using the eval command. You may also pair the eval command with an if condition. Take this for example:
sourcetype="answers-1372957739" | eval head_key_value_for_1=if(login_id=="1",head_key_value,"NULL")
However, that is highly inefficient because you’d have to hard-code each one of the possible values for the login_id into a giant expression.
The solution here is to create the fields dynamically, based on the data in the message. There is a bit magic to make this happen cleanly. Here is the process:
Group the desired data values in head_key_value by the login_id
sourcetype="answers-1372957739" | stats list(head_key_value) AS head_key_value by login_id
Dynamically create the field that will identify the desired head_key_value with the corresponding login_id:
| eval header="head_key_value_for_".login_id
Remove the unnecessary data to match the report exactly as described in this question:
| fields - login_id
Tranform the tabular data, where the new head_key_value_for_{no} header is the column and the associated value are the values for the head_key_value
| eval no_op=" " | xyseries no_op header head_key_value | fields - no_op
All together you will get something like this:
sourcetype="answers-1372957739"
| stats list(head_key_value) AS head_key_value by login_id
| eval header="head_key_value_for_".login_id
| fields - login_id
| eval no_op=" "
| xyseries no_op header head_key_value
| fields - no_op
I hope this is what you were trying to accomplish.
--gc
