Splunk Search

Split one field values into multiple fields based on values

skodak
Explorer

status

success

success

 

failure

failure

error

error

 

I want output like

 

status         status 1 status2

success   failure      error

success   failure    error

Labels (1)
0 Karma
1 Solution

anilchaithu
Builder

@skodak 

you can use eval to split the field values

eval status1=if(like(status, "%failure%"), status, NULL), status2 = if(like(status, "%error%"), status, NULL), status=if(like(status, "%success%"), status, NULL)

 

Hope this helps

View solution in original post

0 Karma

anilchaithu
Builder

@skodak 

you can use eval to split the field values

eval status1=if(like(status, "%failure%"), status, NULL), status2 = if(like(status, "%error%"), status, NULL), status=if(like(status, "%success%"), status, NULL)

 

Hope this helps

0 Karma

skodak
Explorer

Thank you. This helped me to resolve the issue.

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval _raw="status
success
success
failure
failure
error
error"
| multikv forceheader=1
| table status
| rename COMMENT as "the logic"
| streamstats dc(status) as session
| eval session="status".session
| stats list(status) as vstatus by session
| eval {session} = vstatus
| stats list(status*) as status*
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...