Splunk Search

Re design fields and values

Muwafi
Path Finder

I have fields as shown below:

_time                  field1              field2
2020-05-12             40-35-32             A-B-C
2020-05-13             63-28-74             A-B-C

need to change the events to be:

    _time               field1        field2
    2020-05-12             40             A
    2020-05-12             35             B
    2020-05-12             32             C
    2020-05-13             63             A
    2020-05-13             28             B
    2020-05-13             74             C

Appreciate your help fellows Splunkers 😄

0 Karma
1 Solution

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval _time="2020-05-12",field1="40-35-32",field2="A-B-C" 
| append 
    [| makeresults 
    | eval _time="2020-05-13",field1="63-28-74",field2="A-B-C"] 
| eval field1=split(field1,"-"),field2=split(field2,"-") 
| eval temp=mvzip(field1,field2) 
| mvexpand temp 
| eval temp=split(temp,",") 
| eval field1=mvindex(temp,0),field2=mvindex(temp,1) 
| fields - temp

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Check this

| makeresults 
| eval _time="2020-05-12",field1="40-35-32",field2="A-B-C" 
| append 
    [| makeresults 
    | eval _time="2020-05-13",field1="63-28-74",field2="A-B-C"] 
| eval field1=split(field1,"-"),field2=split(field2,"-") 
| eval temp=mvzip(field1,field2) 
| mvexpand temp 
| eval temp=split(temp,",") 
| eval field1=mvindex(temp,0),field2=mvindex(temp,1) 
| fields - temp

View solution in original post

0 Karma

Muwafi
Path Finder

Thank you Brother @vnravikumar , That was so fast

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.