Splunk Search

Spliting multiple events in a transaction column , into seperate columns

Sp3ctre1
New Member

Hi All,

So when im running a transaction based on starts with .... ends with... i'm getting two events of the transaction which is good, in the same column/row.

So i'm looking to check if when using a transaction we can break out multiple events into multiple columns.. such as the photo below

Example: Top row of third column 2018-06-05T13:41:07.610+1000 is in one row/column separate to 2018-06-05T14:30:49.910+1000

alt text

0 Karma

niketn
Legend

@Sp3ctre1 please add more details, adding your current query used to create transaction would help!
What is the field name of each column that you need including the first one with masked data?

Also add a mock up of the final output you need. Do you need to split each column into two new columns? What would be the column names after you split? Would you split even the first column with data masked?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...