Sample EventList for my scenario given below:
ID=1 | Name=sankar | Age=20 | Dept=Computer science | Programming=60 | DataStructure=70 | RDBMS=80 | Compiler=75
ID=2 | Name=Akash | Age=25 | Dept=Mechanical | SolidMechanics=80 | ThermoFluidMechanics=65 | Manufacturing=90
ID=3 | Name=Sathish | Age=18 | Dept=Computer science | Programming=70 | DataStructure=84 | RDBMS=90 | Compiler=85
ID=4 | Name=Arun | Age=24 | Dept=Mechanical | SolidMechanics=70 | ThermoFluidMechanics=55 | Manufacturing=80
ID=5 | Name=Kavya | Age=30 | Dept=Electrical | PhysicalOptics=80 | InformationSecurity=75 | Nanophotonics=90 | ImageProcessing=85 | NonlinearSystemTheory=85
ID=6 | Name=Kaveri | Age=24 | Dept=Computer science | Programming=70 | DataStructure=50 | RDBMS=50 | Compiler=85
ID=7 | Name=Hema | Age=25 | Dept=Electrical | PhysicalOptics=60 | InformationSecurity=85 | Nanophotonics=90 | ImageProcessing=75 | NonlinearSystemTheory=68
ID, Name, Age and Dept fields will be present in all Events without any change in Name, whereas the Courses differs w.r.t Dept.
Resulting Table, i am Excepting as
Instead of the fields as course name for each dept, it has to be renamed as Course1, Course2 etc...
What is the splunk search I need to use to retrieve the above result?
I have tried with the search below, but didn't get the proper result:
index="college_index" | table ID,Name,Age,Dept,* | fields - source*,splunk_server_group,host,_raw date_*,index,linecount,punct,eventtype,splunk_server,_time,time*pos
It shows the table with courseNames only.
Any help will be much appreciated.
Thanks in advance
