Splunk Search

How to use a columns value as a key to a different column for my results id like to output?

zsaf
Explorer
 

I have two columns per event I am trying to use. Well call these col1 and UknownRandomColumnName (urcn for short) . The key of urcn changes from event to event, but the value of col1 will always be the key of urcn. How can I use the value of col1 as a key for the data id like to output from urcn in a search. Example data for my events may look like:

=======================
|    col       |    urcn1    |    urcn2    |
======================
|    urcn1 |    Value    |                     |
---------------------------------------
|    urcn2 |                    |     Value    |
--------------------------------------

Labels (2)
Tags (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

I'm not sure I get what you want but it seems you might need xyseries.

zsaf
Explorer

Hey,  my desired output I guess would be a table with the values from the ucrn columns. 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

As I said - I'm not sure I understand you correctly, but I assume that you have events in the form of

"name: field1name, value: fieldvalue"
"name: field2name, value: fieldvalue"

And you want to get:

field1name: fieldvalue
field2name: fieldvalue

And so on.

Check untable and xyseries (I always confuse those commands) - one of those should do what you need.

zsaf
Explorer

Here would be an example sample of my events.  The type value contains the key of the property I need to display data from. In my example I would like to output the name and age in each object, but I do not know the property name. The only thing I know ahead of time is that the value of type will be the property name I need to access.

{
type: "fwagods",
fwagods: {
    name:"someNameHere",
    age:23
    }
},
{
type: "zsaf",
zsaf: {
    name:"someName2",
    age:65
    }
},
{
type: "smorflafaum",
smorflafaum: {
    name:"SomeName3",
    age:41
    }
}
0 Karma

PickleRick
SplunkTrust
SplunkTrust

That's getting more complicated because you have json and it looks as if you have multiple "subevents" within a single event.

But assuming that you have the jsons as separate events, you can do something like that:

<your_search>
| spath
| foreach *.name
[ eval name='<<FIELD>>'
| eval age='<<MATCHSTR>>.age' ]

 At this point you'll have your name and age fields with constant names and you're gonna have a type as separate field. Now all you have to do is

| xyseries type name age
0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...