Splunk Search

Need help with the format of the fields in splunk query

bhartiya008
Explorer

I have the final result which looks like below:

Host   Date        Total_1   Total_2      To_be_removed
Prod   02-26-2021   456        784         [X,Y,Z]

 

I want something like below :

Host   Date             Summary
Prod  02-26-2021         Total_1:456
                         Total_2:784
	                 To_be_removed:[X,Y,Z]

 How Can I achieve this in splunk search query?

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval _raw="Host   Date        Total_1   Total_2      To_be_removed
Prod   02-26-2021   456        784         [X,Y,Z]"
| multikv forceheader=1
| fields - _raw _time linecount
| foreach * [
  | eval Summary=if("<<FIELD>>" != "Host" AND "<<FIELD>>" != "Date", mvappend(Summary,"<<FIELD>>".":".<<FIELD>>),Summary)
]
| fields Date Host Summary

Main issue with this is that the fields are processed in alphabetic order due to the * - if you want to a specific order, you could do

| makeresults | eval _raw="Host   Date        Total_1   Total_2      To_be_removed
Prod   02-26-2021   456        784         [X,Y,Z]"
| multikv forceheader=1
| fields - _raw _time linecount
| foreach Total_* To_be_removed [
  | eval Summary=mvappend(Summary,"<<FIELD>>".":".<<FIELD>>)
]
| fields Date Host Summary

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval _raw="Host   Date        Total_1   Total_2      To_be_removed
Prod   02-26-2021   456        784         [X,Y,Z]"
| multikv forceheader=1
| fields - _raw _time linecount
| foreach * [
  | eval Summary=if("<<FIELD>>" != "Host" AND "<<FIELD>>" != "Date", mvappend(Summary,"<<FIELD>>".":".<<FIELD>>),Summary)
]
| fields Date Host Summary

Main issue with this is that the fields are processed in alphabetic order due to the * - if you want to a specific order, you could do

| makeresults | eval _raw="Host   Date        Total_1   Total_2      To_be_removed
Prod   02-26-2021   456        784         [X,Y,Z]"
| multikv forceheader=1
| fields - _raw _time linecount
| foreach Total_* To_be_removed [
  | eval Summary=mvappend(Summary,"<<FIELD>>".":".<<FIELD>>)
]
| fields Date Host Summary
0 Karma

bhartiya008
Explorer

Thanks @ITWhisperer  So do I have to add the below lines of code:

| multikv forceheader=1
| fields - _raw _time linecount
| foreach Total_* To_be_removed [
  | eval Summary=mvappend(Summary,"<<FIELD>>".":".<<FIELD>>)
]
| fields Date Host Summary

The last line in my query is | fields + < field_names>

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Just add from (and including) the foreach command - everything prior to that is me setting up a run-anywhere example showing how your example data could be processed.

0 Karma

bhartiya008
Explorer

@ITWhisperer  This works like a charm!! Thanks Much!!

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...