Splunk Search

How to format my data set to sort as a list of individual events by date field?

kenvanderheyden
Path Finder

Hi all,

Working in splunk 6.2.1 enterprise.

I have the following dataset (simplified)

SomeDateField Event1 Event2 Event3
2014-12-29 1 0 0
2014-12-28 0 1 1
2014-12-27 1 1 0

that I would like to convert to this format:

DateField Event
2014-12-29 Event1
2014-12-28 Event2
2014-12-28 Event3
2014-12-27 Event1
2014-12-27 Event2

This would make it possible to get the mean time between events of a type, and last occurrences of the events, ...

So in short:
I would want to create a list of dates for the individual events that happened at that date.
For one date multiple events can occur, so there would be duplicate dates.

Remark: Date field is not _time, it's a specific date from the imported files.
An import file of today can have events of another date.

Tips and hints on how to get this transformation working are welcome.

Thanks,
Ken.

Tags (4)
1 Solution

kml_uvce
Builder

you can try transpose in your event(_raw) field
http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Transpose

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...