Splunk Search

Split results that are in same row

Becherer
Explorer

Currently I am running into an issue where if there is a person logs onto a server multiple times, it combines. Any ideas on how to split?

Here is sample data.

Currently I am using
| stats values(*) as * by Host Account_Name

From This:

HostAccount_NameDurationSession_EndSession_Start
fdk-DC01jfrank 1612536779
1612558813
1612536778
1612558812
fdk-DC01ptom00:00:0216125636971612563695
fdk-Host01jfrank00:00:0516125393221612539317
fdk-Host03bhill 1612540329
1612543822
1612540323
1612543816

 

To This:

HostAccount_NameDurationSession_EndSession_Start
fdk-DC01jfrank 00:00:0316125367791612536778
fdk-DC01jfrank00:00:0716125588131612558812
fdk-DC01ptom00:00:0216125636971612563695
fdk-Host01jfrank00:00:0516125393221612539317
fdk-Host03bhill 00:00:0916125403291612540323
fdk-Host03bhill00:00:01016125438221612543816

 

 

Thank you for any pointers!

Labels (4)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

In addition to @saravanan90 comment, just be aware that when using stats values() the resultant values in the multi-value field will be sorted and duplicates removed, so hence if combining two columns using mvzip you need to know your data will be sensibly sorted to combined item 1+1 and 2+2 from each of the 2 fields.

In your time based case, this is likely, but if doing this with data that might sort alphabetically, this would not always yield the correct pairs.

 

0 Karma

saravanan90
Contributor

This may help..

base query | fields - Duration | eval temp = mvzip(Session_Start, Session_End, ",") | mvexpand temp | makemv delim="," temp | eval Session_Start = mvindex(temp, 0),Session_End = mvindex(temp, 1) | fields - temp | eval Duration=tostring(Session_End-Session_Start,"duration")

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...