Splunk Search

How to dynamically create fields from unique values in a search?

wysmith
Engager

I have a table with users and various fields relating to each event. Here is an example:
user | City | State
user1 | SLO | CA
user1 | SLO | CA
user1 | LA | CA
user2 | PHX | AZ

I want to merge each the entries by user, and move the unique values in every field to new fields and have the values of the new fields be the ratio like so:
user | City-SLO | City-LA | City-PHX | State-CA | State-AZ
user1 | .66 | .33 | 0 | 1 | 0
user2 | 0 | 0 | 1 | 0 | 1

I tried to do this using the foreach command, but it didn't work as expected (the value 0 is put in just for experimenting and will be changed):

 ... | foreach * [eval <<FIELD>>-"<<FIELD>>"=0]

Is there a way to create new fields based on dynamic data?

Sorry about the poor description and the crude tables.

0 Karma

wysmith
Engager

I found the answer here: http://answers.splunk.com/answers/103700/how-do-i-create-a-field-whose-name-is-the-value-of-another-...

Apparently, it isn't documented, but you can use curly braces to get the value of the field. This is my final foreach query:
... | foreach * [eval <>-{<>}=<>]

0 Karma
Get Updates on the Splunk Community!

The Payment Operations Wake-Up Call: Why Financial Institutions Can't Afford ...

The same scenario plays out across financial institutions daily. A payment system fails at 11:30 AM on a busy ...

Make Your Case: A Ready-to-Send Letter for Getting Approval to Attend .conf25

Hello Splunkers, Want to attend .conf25 in Boston this year but not sure how to convince your manager? We've ...

Community Spotlight: A Splunk Expert's Journey

In the world of data analytics, some journeys leave a lasting impact not only on the individual but on the ...