Splunk Search

How to sort data?

jaydiare
Explorer

Hello, I wonder if somebody can please help me to sort the following data:

jaydiare_0-1694807431957.png

Into this table:

jaydiare_1-1694807459588.png

Any ideas are welcome

I was trying to run this query but it is not separating the values of the fields properly:

index=query_mcc | eval data = split(_raw, ",") | eval Date = strftime(_time, "%Y-%m-%d-%H:%M:%S") | eval Category = mvindex(data, 1) | eval Status = mvindex(data, -1) | eval Command = mvindex(data, 0) | table host, Date, Category, Status, Command

 

but is giving me this , where it only shows the first line.. 

jaydiare_0-1694810092225.png

 

 

 

 

 

 

Labels (4)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Regardless of splitting the event, there is no "merged" cells in Splunk. So you can't visualize it this way.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=query_mcc 
| eval data=split(_raw,"
")
| mvexpand data
| eval data = split(data, ",")
| eval Date = strftime(_time, "%Y-%m-%d-%H:%M:%S") 
| eval Category = mvindex(data, 1) 
| eval Status = mvindex(data, -1) 
| eval Command = mvindex(data, 0) 
| table host, Date, Category, Status, Command
0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...