Splunk Search

Split one field values into multiple fields based on values

skodak
Explorer

status

success

success

 

failure

failure

error

error

 

I want output like

 

status         status 1 status2

success   failure      error

success   failure    error

Labels (1)
0 Karma
1 Solution

anilchaithu
Builder

@skodak 

you can use eval to split the field values

eval status1=if(like(status, "%failure%"), status, NULL), status2 = if(like(status, "%error%"), status, NULL), status=if(like(status, "%success%"), status, NULL)

 

Hope this helps

View solution in original post

0 Karma

anilchaithu
Builder

@skodak 

you can use eval to split the field values

eval status1=if(like(status, "%failure%"), status, NULL), status2 = if(like(status, "%error%"), status, NULL), status=if(like(status, "%success%"), status, NULL)

 

Hope this helps

0 Karma

skodak
Explorer

Thank you. This helped me to resolve the issue.

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval _raw="status
success
success
failure
failure
error
error"
| multikv forceheader=1
| table status
| rename COMMENT as "the logic"
| streamstats dc(status) as session
| eval session="status".session
| stats list(status) as vstatus by session
| eval {session} = vstatus
| stats list(status*) as status*
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...