Splunk Search

Split Table by Field

p3hndrx
Explorer

Greetings...

I have a table that looks like:

Timestamp | Action | User
YYYY-MM-DD HH:MM:SS| Fail | User1
YYYY-MM-DD HH:MM:SS | Succeed| User2
YYYY-MM-DD HH:MM:SS| Succeed| User1
YYYY-MM-DD HH:MM:SS| Succeed| User1
YYYY-MM-DD HH:MM:SS| Fail| User2

Is there a way to break this down into separate tables by User such that:
YYYY-MM-DD HH:MM:SS| Fail | User1
YYYY-MM-DD HH:MM:SS| Succeed| User1
YYYY-MM-DD HH:MM:SS| Succeed| User1

YYYY-MM-DD HH:MM:SS | Succeed| User2
YYYY-MM-DD HH:MM:SS| Fail| User2

Labels (1)

to4kawa
Ultra Champion

That's right, because it wasn't in the request.

0 Karma

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw | eval _raw="Timestamp | Action | User
YYYY-MM-DD HH:MM:SS | Fail | User1
YYYY-MM-DD HH:MM:SS | Succeed | User2
YYYY-MM-DD HH:MM:SS | Succeed | User1
YYYY-MM-DD HH:MM:SS | Succeed | User1
YYYY-MM-DD HH:MM:SS | Fail | User2"
| rename COMMENT as "these are your log sample. from here, the logic"
| rex mode=sed "s/( \| )/,/g"
| multikv forceheader=1
| table Timestamp Action User
| sort User
| autoregress User
| streamstats count as tmp
| eval User=mvdedup(mvappend(User,User_p1))
| fields - User_p1
| mvexpand User
| streamstats count by tmp
| sort User
| foreach * [ eval <<FIELD>>=if(count=2,NULL,'<<FIELD>>')]
| table Timestamp Action User

It's not easy to open a line.

p3hndrx
Explorer

This gets me pretty close.

I guess there is no trellis for a stats table.

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...