Hi,
I'm a Splunk beginner here. I'm not even sure if I'm using the right terms. Kindly bear with me.
My input is a JSON file, where I have a Key 'key1' holding Value 'value1', 'key2'='value2', etc.,.
In Splunk, I see "key1" as the column name and the field value as "value1" and so on.
Now, my table already has another column with the name value1". I want to extract the column "value1" from the table.
In C/C++ terms, using value of "key1" as the index, i.e.: result = *key1;
I seem to be able to do this with something like:
| makeresults
| eval key1="value1"
| eval value1="my_string1", value2="mystring2"
| foreach *
[ eval result=if("<<FIELD>>"==key1,<<FIELD>>,result)]
| table key1, result
Output:
key1 | result
value1 | "mystring1"
But, I'm sure there should be a simpler way to do the same. All I want to do is:
result = valueof(key1's value)
Also, how would I go about doing the same if my Key1 has multiple values, where each one is a separate field?
Any ideas? Thanks!
