Splunk Search

Spliting multiple events in a transaction column , into seperate columns

Sp3ctre1
New Member

Hi All,

So when im running a transaction based on starts with .... ends with... i'm getting two events of the transaction which is good, in the same column/row.

So i'm looking to check if when using a transaction we can break out multiple events into multiple columns.. such as the photo below

Example: Top row of third column 2018-06-05T13:41:07.610+1000 is in one row/column separate to 2018-06-05T14:30:49.910+1000

alt text

0 Karma

niketnilay
Legend

@Sp3ctre1 please add more details, adding your current query used to create transaction would help!
What is the field name of each column that you need including the first one with masked data?

Also add a mock up of the final output you need. Do you need to split each column into two new columns? What would be the column names after you split? Would you split even the first column with data masked?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!