Splunk Search

How to display nested tables?

amerineni
Loves-to-Learn

My events looks like this: REQUEST_NAME is the common field that ties both request and services.

LogType=REQUEST status=200 REQUEST_NAME=XXXX              URI=REQ1
LogType=SERVICE status=200 REQUEST_NAME=XXXX              URI=SER1
LogType=SERVICE status=200 REQUEST_NAME=XXXX              URI=SER2
LogType=SERVICE status=200 REQUEST_NAME=XXXX              URI=SER3
LogType=REQUEST status=200 REQUEST_NAME=YYYY              URI=REQ2
LogType=SERVICE status=200 REQUEST_NAME=YYYY              URI=SER1

I want to see if this display is possible in a table format. Thanks for the help.

XXXX       200                                                       SER1 200  
                                                                     SER2 200
                                                                     SER2 200
YYYY       300                                                       SER1 200 
0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults
| eval _raw=" LogType=REQUEST status=200 REQUEST_NAME=XXXX              URI=REQ1
 LogType=SERVICE status=200 REQUEST_NAME=XXXX              URI=SER1
 LogType=SERVICE status=200 REQUEST_NAME=XXXX              URI=SER2
 LogType=SERVICE status=200 REQUEST_NAME=XXXX              URI=SER3
 LogType=REQUEST status=200 REQUEST_NAME=YYYY              URI=REQ2
 LogType=SERVICE status=200 REQUEST_NAME=YYYY              URI=SER1"
 | multikv noheader=t 
 | fields _raw
 | kv
 | sort URI
 | where LogType="SERVICE"
 | stats list(URI) as URI list(status) as status by REQUEST_NAME

result:

REQUEST_NAME    URI status
XXXX    SER1    200
        SER2    200
        SER3    200
YYYY    SER1    200

what's 300 in your sample?

View solution in original post

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval _raw=" LogType=REQUEST status=200 REQUEST_NAME=XXXX              URI=REQ1
 LogType=SERVICE status=200 REQUEST_NAME=XXXX              URI=SER1
 LogType=SERVICE status=200 REQUEST_NAME=XXXX              URI=SER2
 LogType=SERVICE status=200 REQUEST_NAME=XXXX              URI=SER3
 LogType=REQUEST status=200 REQUEST_NAME=YYYY              URI=REQ2
 LogType=SERVICE status=200 REQUEST_NAME=YYYY              URI=SER1"
 | multikv noheader=t 
 | fields _raw
 | kv
 | sort URI
 | where LogType="SERVICE"
 | stats list(URI) as URI list(status) as status by REQUEST_NAME

result:

REQUEST_NAME    URI status
XXXX    SER1    200
        SER2    200
        SER3    200
YYYY    SER1    200

what's 300 in your sample?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...