Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Splunk Search
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Split one field values into multiple fields based ...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
skodak
Explorer
07-10-2020
03:35 AM
status
success
success
failure
failure
error
error
I want output like
status status 1 status2
success failure error
success failure error
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
anilchaithu
Builder
07-10-2020
06:01 AM
you can use eval to split the field values
eval status1=if(like(status, "%failure%"), status, NULL), status2 = if(like(status, "%error%"), status, NULL), status=if(like(status, "%success%"), status, NULL)
Hope this helps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
anilchaithu
Builder
07-10-2020
06:01 AM
you can use eval to split the field values
eval status1=if(like(status, "%failure%"), status, NULL), status2 = if(like(status, "%error%"), status, NULL), status=if(like(status, "%success%"), status, NULL)
Hope this helps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
skodak
Explorer
07-10-2020
07:16 PM
Thank you. This helped me to resolve the issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
to4kawa
Ultra Champion
07-10-2020
05:07 PM
| makeresults
| eval _raw="status
success
success
failure
failure
error
error"
| multikv forceheader=1
| table status
| rename COMMENT as "the logic"
| streamstats dc(status) as session
| eval session="status".session
| stats list(status) as vstatus by session
| eval {session} = vstatus
| stats list(status*) as status*
Get Updates on the Splunk Community!
Splunk and TLS: It doesn't have to be too hard
Overview
Creating a TLS cert for Splunk usage is pretty much standard openssl. To make life better, use an ...
Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...
Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...
Splunk Enterprise Security: Your Command Center for PCI DSS Compliance
Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...
