Hi all,
I would like to make the values of a column the column names for a table.
Currently, I am using the command to get the result
......|table Job SubJob Action Value
And I would like to make the "action" column value to be a column name. In addition, if the action=result and value is True, it returns "Success", if it is "false", it returns "Failed", otherwise, it returns "In Progress".
The result is similar like that.
Hi,
there might be an easier way, because this is pretty complicated / complex. But maybe you can go on from here:
| inputlookup answers.csv | stats list(*) by Job | eval fields = mvzip('list(Action)','list(Value)') | mvexpand fields | rex field=fields "start\,(?<Start>.*)" | rex field=fields "end\,(?<End>.*)" | rex field=fields "remark\,(?<Remark>.*)" | eval Result=if(mvfind('list(Action)',"result")>= 0 AND mvfind('list(Value)',"TRUE")>= 0,"Success",if(mvfind('list(Action)',"result")>= 0 AND mvfind('list(Value)',"FALSE")>= 0,"Failed","In Progress")) | table Job Start End Result Remark | stats list(*) by Job | mvexpand list(Result) | dedup Job | rename list(End) AS End list(Start) as Start list(Result) as Result list(Remark) as Remark | eval Time=((strptime(End, "%H:%M") - strptime(Start, "%H:%M")) / 60)." min" | table Job Start End Time Result Remark
I used the inputlookup to get the table you mentioned as starting point. You have to replace the inputlookup by your search untill your table command.
Here is another solution I came across https://community.splunk.com/t5/Splunk-Search/Field-results-as-table-column-headings/m-p/66771
that might work. It's using the chart command.
Hi,
there might be an easier way, because this is pretty complicated / complex. But maybe you can go on from here:
| inputlookup answers.csv | stats list(*) by Job | eval fields = mvzip('list(Action)','list(Value)') | mvexpand fields | rex field=fields "start\,(?<Start>.*)" | rex field=fields "end\,(?<End>.*)" | rex field=fields "remark\,(?<Remark>.*)" | eval Result=if(mvfind('list(Action)',"result")>= 0 AND mvfind('list(Value)',"TRUE")>= 0,"Success",if(mvfind('list(Action)',"result")>= 0 AND mvfind('list(Value)',"FALSE")>= 0,"Failed","In Progress")) | table Job Start End Result Remark | stats list(*) by Job | mvexpand list(Result) | dedup Job | rename list(End) AS End list(Start) as Start list(Result) as Result list(Remark) as Remark | eval Time=((strptime(End, "%H:%M") - strptime(Start, "%H:%M")) / 60)." min" | table Job Start End Time Result Remark
I used the inputlookup to get the table you mentioned as starting point. You have to replace the inputlookup by your search untill your table command.