Splunk Search

How to make the values in a column the column names for a table?

chrismok
Path Finder

Hi all,

I would like to make the values of a column the column names for a table.

Currently, I am using the command to get the result

......|table Job SubJob Action Value

alt text

And I would like to make the "action" column value to be a column name. In addition, if the action=result and value is True, it returns "Success", if it is "false", it returns "Failed", otherwise, it returns "In Progress".

The result is similar like that.

alt text

Tags (2)
1 Solution

tom_frotscher
Builder

Hi,

there might be an easier way, because this is pretty complicated / complex. But maybe you can go on from here:

| inputlookup answers.csv | stats list(*) by Job | eval fields = mvzip('list(Action)','list(Value)') | mvexpand fields | rex field=fields "start\,(?<Start>.*)" | rex field=fields "end\,(?<End>.*)" | rex field=fields "remark\,(?<Remark>.*)" | eval Result=if(mvfind('list(Action)',"result")>= 0 AND mvfind('list(Value)',"TRUE")>= 0,"Success",if(mvfind('list(Action)',"result")>= 0 AND mvfind('list(Value)',"FALSE")>= 0,"Failed","In Progress")) | table Job Start End Result Remark | stats list(*) by Job | mvexpand list(Result) | dedup Job | rename list(End) AS End list(Start) as Start list(Result) as Result list(Remark) as Remark | eval Time=((strptime(End, "%H:%M") - strptime(Start, "%H:%M")) / 60)." min" | table Job Start End Time Result Remark

I used the inputlookup to get the table you mentioned as starting point. You have to replace the inputlookup by your search untill your table command.

View solution in original post

rtoloczk
Explorer

Here is another solution I came across https://community.splunk.com/t5/Splunk-Search/Field-results-as-table-column-headings/m-p/66771

that might work. It's using the chart command. 

 

 

Tags (1)
0 Karma

tom_frotscher
Builder

Hi,

there might be an easier way, because this is pretty complicated / complex. But maybe you can go on from here:

| inputlookup answers.csv | stats list(*) by Job | eval fields = mvzip('list(Action)','list(Value)') | mvexpand fields | rex field=fields "start\,(?<Start>.*)" | rex field=fields "end\,(?<End>.*)" | rex field=fields "remark\,(?<Remark>.*)" | eval Result=if(mvfind('list(Action)',"result")>= 0 AND mvfind('list(Value)',"TRUE")>= 0,"Success",if(mvfind('list(Action)',"result")>= 0 AND mvfind('list(Value)',"FALSE")>= 0,"Failed","In Progress")) | table Job Start End Result Remark | stats list(*) by Job | mvexpand list(Result) | dedup Job | rename list(End) AS End list(Start) as Start list(Result) as Result list(Remark) as Remark | eval Time=((strptime(End, "%H:%M") - strptime(Start, "%H:%M")) / 60)." min" | table Job Start End Time Result Remark

I used the inputlookup to get the table you mentioned as starting point. You have to replace the inputlookup by your search untill your table command.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...