I have a multivalue field (custom_4) separated by dollar signs that I have separated in to separate values with the below search. However, that only separate each value to a different line on the same row. I would like to create column headers for each new value and put each new value under a column header. Basically, when I split the multi value field using makemv I want the new single values to appear across the row for the same record with separate column names instead of just multiple rows as it is now. The new column headers (fields) would be: Tool, ID, Severity,Incident Id, Progress. Thanks!
index=UIM sourcetype=nas_transaction_log
| makemv delim="$" custom_4
| top limit=20 custom_4
Before:
"Tool name"
"ID#"
"Severity"
"incident id#"
"status"
What I want:
Tool ID Severity Incident ID Progress
"Tool name" "ID#" "severity" "incident#" "status"
Here's one (untested) way. There may be others.
index=UIM sourcetype=nas_transaction_log
| makemv delim="$" custom_4
| eval Tool=mvindex(custom_4,0), ID=mvindex(custom_4, 1), Severity=mvindex(custom_4, 2), 'Incident ID'=mvindex(custom_4, 3), Progress=mvindex(custom_4, 4)
Here's one (untested) way. There may be others.
index=UIM sourcetype=nas_transaction_log
| makemv delim="$" custom_4
| eval Tool=mvindex(custom_4,0), ID=mvindex(custom_4, 1), Severity=mvindex(custom_4, 2), 'Incident ID'=mvindex(custom_4, 3), Progress=mvindex(custom_4, 4)