I am importing SQL data into Splunk.
Each record contains SessionID, message, and VarValue.
SessionID is always unique, but message and VarValue contain different values
Example
Sessionid = 1234,message="Tower", varValue="site1"
SessionID = 1234,message="Platform",varValue="Wireless"
SessionID = 1234,message="City",varValue="mytown"
Sessionid = 2222,message="Tower", varValue="site2"
SessionID = 2222,message="Platform",varValue="Satellite"
SessionID = 2222,message="City",varValue="mytown"
How can I extract the unique message and varValue into separate variables per unique SessionID?
What I would like to do is display the Platform and City within a single search
If the data is already in Splunk, and the three fields have been extracted, see if this works (may need some tweaking)
base search here | eval {message}=varValue | stats values(Tower) as Tower values(Platform) as Platform values(City) as City by SessionID
If the fields are not extracted, try this
base search here | extract pairdelim="," kvdelim="=" | eval {message}=varValue | stats values(Tower) as Tower values(Platform) as Platform values(City) as City by SessionID
If the data is already in Splunk, and the three fields have been extracted, see if this works (may need some tweaking)
base search here | eval {message}=varValue | stats values(Tower) as Tower values(Platform) as Platform values(City) as City by SessionID
If the fields are not extracted, try this
base search here | extract pairdelim="," kvdelim="=" | eval {message}=varValue | stats values(Tower) as Tower values(Platform) as Platform values(City) as City by SessionID
That worked. Thanks alot!
Only thing is no timestamps are shown when I do the following. Any ideas how to get timestamps?
base search here | extract pairdelim="," kvdelim="=" | eval {message}=varValue | stats values(Tower) as Tower values(Platform) as Platform values(City) as City by SessionID | table _time Tower Platform City SessionID
Like this
base search here | extract pairdelim="," kvdelim="=" | eval {message}=varValue | table _time Tower Platform City SessionID