Splunk Search

How to split by comma and use values as field names?

JykkeDaMan
Path Finder

I have the following fields, where some of them might be null, empty, whatnot values.

I would like to split the Services values, which might have 1-N values separated by a comma, to separate columns/fields prefixed with "Sp.".

For example:

| makeresults 
| eval Platform="p1", Ent="ent1", Ext="100", Fieldx=null(), Fieldy="" , Services="user,role,func1,func2"
| append [
| makeresults
| eval Platform="p1", Ent="ent2", Ext="100", Fieldx="", Fieldy=null(), Services="user2,role2,func4,func8,func5,role3"
]
| fields _time Platform Ent Ext Fieldx Fieldy Services

Gives an example like:

_timePlatformEntExtFiledxFieldyServices
2022-09-30 08:56:11p1ent1100  user,role,func1,func2
2022-09-30 08:56:11p1ent2100  user2,role2,func4,func8,func5,role3

 

How do I split the Services into a separate fields?

I think I cannot just use stats list() by "All_fields" due to those possible null values in other fields.

_timePlatformEntExtFieldxFieldyServicesSp.func1Sp.func2Sp.func4Sp.func5Sp.func8Sp.roleSp.role2Sp.role3Sp.userSp.user2
2022-09-30 09:07:00p1ent1100  user,role,func1,func2func1func2   role  user 
2022-09-30 09:07:00p1ent2100  user2,role2,func4,func8,func5,role3  func4func5func8 role2role3 user2

 

Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@JykkeDaMan 

Can you please try this?

| makeresults 
| eval Platform="p1", Ent="ent1", Ext="100", Fieldx=null(), Fieldy="" , Services="user,role,func1,func2" 
| append 
    [| makeresults 
    | eval Platform="p1", Ent="ent2", Ext="100", Fieldx="", Fieldy=null(), Services="user2,role2,func4,func8,func5,role3"
        ] 
| fields _time Platform Ent Ext Fieldx Fieldy Services | eval a=1 | accum a
| eval Services_mv = split(Services,",")
| mvexpand Services_mv
| eval Sp.{Services_mv}=Services_mv
|fields - Services_mv
|stats values(*) as * by a
|fields - a

 

Screenshot 2022-09-30 at 1.22.48 PM.png

 

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated. 

View solution in original post

0 Karma

JykkeDaMan
Path Finder

Indeed, stats(*) as * by <field_always_exist> :-).

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval service=split(Services,",")
| streamstats count as _row
| mvexpand service
| eval {service}=service
| stats values(*) as * by _row
| fields - _row service
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@JykkeDaMan 

Can you please try this?

| makeresults 
| eval Platform="p1", Ent="ent1", Ext="100", Fieldx=null(), Fieldy="" , Services="user,role,func1,func2" 
| append 
    [| makeresults 
    | eval Platform="p1", Ent="ent2", Ext="100", Fieldx="", Fieldy=null(), Services="user2,role2,func4,func8,func5,role3"
        ] 
| fields _time Platform Ent Ext Fieldx Fieldy Services | eval a=1 | accum a
| eval Services_mv = split(Services,",")
| mvexpand Services_mv
| eval Sp.{Services_mv}=Services_mv
|fields - Services_mv
|stats values(*) as * by a
|fields - a

 

Screenshot 2022-09-30 at 1.22.48 PM.png

 

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated. 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...