Splunk Search

How to make the values in a column the column names for a table?

chrismok
Path Finder

Hi all,

I would like to make the values of a column the column names for a table.

Currently, I am using the command to get the result

......|table Job SubJob Action Value

alt text

And I would like to make the "action" column value to be a column name. In addition, if the action=result and value is True, it returns "Success", if it is "false", it returns "Failed", otherwise, it returns "In Progress".

The result is similar like that.

alt text

Tags (2)
1 Solution

tom_frotscher
Builder

Hi,

there might be an easier way, because this is pretty complicated / complex. But maybe you can go on from here:

| inputlookup answers.csv | stats list(*) by Job | eval fields = mvzip('list(Action)','list(Value)') | mvexpand fields | rex field=fields "start\,(?<Start>.*)" | rex field=fields "end\,(?<End>.*)" | rex field=fields "remark\,(?<Remark>.*)" | eval Result=if(mvfind('list(Action)',"result")>= 0 AND mvfind('list(Value)',"TRUE")>= 0,"Success",if(mvfind('list(Action)',"result")>= 0 AND mvfind('list(Value)',"FALSE")>= 0,"Failed","In Progress")) | table Job Start End Result Remark | stats list(*) by Job | mvexpand list(Result) | dedup Job | rename list(End) AS End list(Start) as Start list(Result) as Result list(Remark) as Remark | eval Time=((strptime(End, "%H:%M") - strptime(Start, "%H:%M")) / 60)." min" | table Job Start End Time Result Remark

I used the inputlookup to get the table you mentioned as starting point. You have to replace the inputlookup by your search untill your table command.

View solution in original post

rtoloczk
Explorer

Here is another solution I came across https://community.splunk.com/t5/Splunk-Search/Field-results-as-table-column-headings/m-p/66771

that might work. It's using the chart command. 

 

 

Tags (1)
0 Karma

tom_frotscher
Builder

Hi,

there might be an easier way, because this is pretty complicated / complex. But maybe you can go on from here:

| inputlookup answers.csv | stats list(*) by Job | eval fields = mvzip('list(Action)','list(Value)') | mvexpand fields | rex field=fields "start\,(?<Start>.*)" | rex field=fields "end\,(?<End>.*)" | rex field=fields "remark\,(?<Remark>.*)" | eval Result=if(mvfind('list(Action)',"result")>= 0 AND mvfind('list(Value)',"TRUE")>= 0,"Success",if(mvfind('list(Action)',"result")>= 0 AND mvfind('list(Value)',"FALSE")>= 0,"Failed","In Progress")) | table Job Start End Result Remark | stats list(*) by Job | mvexpand list(Result) | dedup Job | rename list(End) AS End list(Start) as Start list(Result) as Result list(Remark) as Remark | eval Time=((strptime(End, "%H:%M") - strptime(Start, "%H:%M")) / 60)." min" | table Job Start End Time Result Remark

I used the inputlookup to get the table you mentioned as starting point. You have to replace the inputlookup by your search untill your table command.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...