Splunk Search

How to join data and extract field values as field names?

splunk_worker
Path Finder

How to change event field values into field name?

Event log sample1:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
id, code, message
1, 1111, "one"
3, 12345, "three"

Event log sample2:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`
id, keyname, keyvalue
1, name , john
1, place, richmond
1, activity, login
1, environment, mobile
2, name , bob
2, lastname, bill
3, name, charle
3, location, newyork
3, activity, transaction
4 name, Danny
4 lastname, Huber
5, name, eugene

Both event have common field called "id". I will join both data searches using join command.
e.g: index=abc code=111 | join id [search index=blah ]

But my requirement is, for the above search when the code is 111, i need get the table in following format
id, code, message, name, place, activity, environment
1 , 1111, "one", john, richmond, login, mobile

Please note that, the values of keyname and keyvalue are become field-name and its values respectively. Please let me know how to do this?

0 Karma

somesoni2
Revered Legend

Try this

index=abc code=1111 | join id [search index=blah | xyseries id keyname keyvalue]

OR

index=abc code=1111 | join id [search index=blah | chart first(keyvalue) over id by keyname]
0 Karma

strive
Influencer

Try this

 index=abc  code=1111 | join id[search index=blah | chart first(keyvalue) by id keyname]
0 Karma

strive
Influencer

In your question, you said you need it for code 1111. Take out the condition code=1111 and execute the search.

0 Karma

splunk_worker
Path Finder

Thanks for ur response.

The above searching is putting keyname parameter values as column variables (this 100% fine). But the value from keyvalue is displayed only for one column variable ( created from keyname) per id.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...