Splunk Search

Swap field and values

muebel
SplunkTrust
SplunkTrust

I have a list of fields within a Datamodel collected as values within the field named "unknown"

| datamodel Authentication Authentication 
| table * 
| spath 
| table fields{}.displayName 
| rename fields{}.displayName as unknown 
| mvexpand unknown

This gives:
alt text

I'd like to extend this search to give me a table with fields "dest_bunit", "dest_category" etc, all with a value of "unknown"

Ultimately this would be used as a subsearch within tstats to find events that have unknown values for any of the values within the datamodel.

More straightforward (and equally dynamic) would probably serve as an answer to this as well.

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

| datamodel Authentication Authentication 
 | table * 
 | spath 
 | table fields{}.displayName 
 | rename fields{}.displayName as unknown 
 | mvexpand unknown | eval temp=1 | eval data="unknown" | xyseries temp unknown data | fields - temp

View solution in original post

somesoni2
Revered Legend

Try like this

| datamodel Authentication Authentication 
 | table * 
 | spath 
 | table fields{}.displayName 
 | rename fields{}.displayName as unknown 
 | mvexpand unknown | eval temp=1 | eval data="unknown" | xyseries temp unknown data | fields - temp

View solution in original post

muebel
SplunkTrust
SplunkTrust

I had thought that xyseries and/or untable had something to do with the solution. I need to understand those commands better. Thanks!

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!