Splunk Search

How to sort data?

jaydiare
Explorer

Hello, I wonder if somebody can please help me to sort the following data:

jaydiare_0-1694807431957.png

Into this table:

jaydiare_1-1694807459588.png

Any ideas are welcome

I was trying to run this query but it is not separating the values of the fields properly:

index=query_mcc | eval data = split(_raw, ",") | eval Date = strftime(_time, "%Y-%m-%d-%H:%M:%S") | eval Category = mvindex(data, 1) | eval Status = mvindex(data, -1) | eval Command = mvindex(data, 0) | table host, Date, Category, Status, Command

 

but is giving me this , where it only shows the first line.. 

jaydiare_0-1694810092225.png

 

 

 

 

 

 

Labels (4)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Regardless of splitting the event, there is no "merged" cells in Splunk. So you can't visualize it this way.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=query_mcc 
| eval data=split(_raw,"
")
| mvexpand data
| eval data = split(data, ",")
| eval Date = strftime(_time, "%Y-%m-%d-%H:%M:%S") 
| eval Category = mvindex(data, 1) 
| eval Status = mvindex(data, -1) 
| eval Command = mvindex(data, 0) 
| table host, Date, Category, Status, Command
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...