Splunk Search

Split results that are in same row

Becherer
Explorer

Currently I am running into an issue where if there is a person logs onto a server multiple times, it combines. Any ideas on how to split?

Here is sample data.

Currently I am using
| stats values(*) as * by Host Account_Name

From This:

HostAccount_NameDurationSession_EndSession_Start
fdk-DC01jfrank 1612536779
1612558813
1612536778
1612558812
fdk-DC01ptom00:00:0216125636971612563695
fdk-Host01jfrank00:00:0516125393221612539317
fdk-Host03bhill 1612540329
1612543822
1612540323
1612543816

 

To This:

HostAccount_NameDurationSession_EndSession_Start
fdk-DC01jfrank 00:00:0316125367791612536778
fdk-DC01jfrank00:00:0716125588131612558812
fdk-DC01ptom00:00:0216125636971612563695
fdk-Host01jfrank00:00:0516125393221612539317
fdk-Host03bhill 00:00:0916125403291612540323
fdk-Host03bhill00:00:01016125438221612543816

 

 

Thank you for any pointers!

Labels (4)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

In addition to @saravanan90 comment, just be aware that when using stats values() the resultant values in the multi-value field will be sorted and duplicates removed, so hence if combining two columns using mvzip you need to know your data will be sensibly sorted to combined item 1+1 and 2+2 from each of the 2 fields.

In your time based case, this is likely, but if doing this with data that might sort alphabetically, this would not always yield the correct pairs.

 

0 Karma

saravanan90
Contributor

This may help..

base query | fields - Duration | eval temp = mvzip(Session_Start, Session_End, ",") | mvexpand temp | makemv delim="," temp | eval Session_Start = mvindex(temp, 0),Session_End = mvindex(temp, 1) | fields - temp | eval Duration=tostring(Session_End-Session_Start,"duration")

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...