Splunk Search

Need help

teewenjie22
Engager

How to convert below 

_time    Server      col1     col2       col3

8am       SerA          1           2             3

9pm       SerA          5           6             7


into 

_time       Category          value        
8am           SerA_col1      1
8am           SerA_col2      2
8am           SerA_col3      3
9pm           SerB_col1      5
9pm           SerB_col2      6
9pm           SerB_col3      7

 

 

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@teewenjie22 

Try this. Update search as per your requirement. 

YOUR_SEARCH
| eval F="",V=""
| foreach col* [| eval F=if(F="","<<FIELD>>",F."|"."<<FIELD>>"), V=if(V="",'<<FIELD>>',V."|".'<<FIELD>>')]
| eval F=split(F,"|"),V=split(V,"|")
| eval t=mvzip(F,V) | fields - F V col*
| mvexpand t
| eval Category=Server."_".mvindex(split(t,","),0), value=mvindex(split(t,","),1) |fields time Category value

 

Sample:

| makeresults 
| eval _raw="time    Server      col1     col2       col3
8am       SerA          1           2             3
9pm       SerA          5           6             7" 
| multikv forceheader=1
| table time    Server      col1     col2       col3
| eval F="",V=""
| foreach col* [| eval F=if(F="","<<FIELD>>",F."|"."<<FIELD>>"), V=if(V="",'<<FIELD>>',V."|".'<<FIELD>>')]
| eval F=split(F,"|"),V=split(V,"|")
| eval t=mvzip(F,V) | fields - F V col*
| mvexpand t
| eval Category=Server."_".mvindex(split(t,","),0), value=mvindex(split(t,","),1) |fields time Category value

 

Thanks
KV
▄︻̷̿┻̿═━一

If this reply helps you, an upvote would be appreciated.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...