Hi
I have Splunk messages that gives the information on course and student enrolled.
My sample message as follows
{
ID:1,
Course:Biology,
UserName:gsmith,
FirstName: George,
LastName:Smith,
NumOfCredits:3
},
{
ID:2,
Course:Biology,
UserName:mmuren,
FirstName: Mary,
LastName:Muren,
NumOfCredits:3
},
{
ID:3,
Course:Biology,
UserName:ksmith,
FirstName: Karen,
LastName:Smith,
NumOfCredits:3
}
And with my search
index=* Application=Course_Details | stats values(Course), values(UserName), values(FirstName), values(LastName), values(NumOfCredits) by ID
| table Course UserName FirstName LastName NumOfCredits
The result is something like this:
Course UserName FirstName LastName NumOfCredits
Biology gsmith George Smith 3
mmuren Mary Muren
ksmith Karen
The result that I am expecting is:
Course UserName FirstName LastName NumOfCredits
Biology gsmith George Smith 3
mmuren Mary Muren 3
ksmith Karen Smith 3
Tried using makemv
but that did not work. Could you please help?
Thanks.
| makeresults
| eval _raw="{\"ID\":1,\"Course\":\"Biology\",\"UserName\":\"gsmith\",\"FirstName\":\"George\",\"LastName\":\"Smith\",\"NumOfCredits\":3},{\"ID\":2,\"Course\":\"Biology\",\"UserName\":\"mmuren\",\"FirstName\":\"Mary\",\"LastName\":\"Muren\",\"NumOfCredits\":3},{\"ID\":3,\"Course\":\"Biology\",\"UserName\":\"ksmith\",\"FirstName\":\"Karen\",\"LastName\":\"Smith\",\"NumOfCredits\":3}"
| rex max_match=100 "\"ID\":(?<ID>\d+),\"Course\":\"(?<Course>.+?)\",\"UserName\":\"(?<UserName>.+?)\",\"FirstName\":\"(?<FirstName>.+?)\",\"LastName\":\"(?<LastName>.+?)\",\"NumOfCredits\":(?<NumOfCredits>\d+)"
| fields - _*
`comment("this is sample data")`
| stats list(*) as * by ID
| rename ID as _ID
| foreach *
[eval <<FIELD>> = mvindex(<<FIELD>>, _ID - 1) ]
| stats list(*) as * by Course
Hi, @gravi
How about this?
This might work. I just used list
instead of values
and that did the trick.