I am pretty new to splunk and i have a query which uses TABLE command to filter output on certain fields. The output looks like:
name designation salary
ABC Manager 12345
XYZ Clerk 6789
I want to convert the output as:
name=ABC, designation=Manager, salary=12345
name=XYZ, designation=Clerk, salary=6789
Not sure how to transform the data. Can anyone help?
This is a more generic solution to the problem, using the foreach command. This will concatenate any set of fields into a new field called tmp. It won't guarantee any order though.
| makeresults
| eval _raw="name designation salary
ABC Manager 12345
XYZ Clerk 6789"
| multikv forceheader=1
| table name designation salary
| eval tmp=""
| foreach * [ eval tmp=if("<<MATCHSTR>>"="tmp", tmp, tmp.",<<MATCHSTR>>=".<<FIELD>>) ]
| eval tmp=substr(tmp,2)
The last 3 lines do the work.
If its a definite set of fields , you can just concatenate them
|eval output="name=".name.",deignation=".designation.",salary=".salary|fields output
Run anywhere example
|makeresults|eval name="ABC XYZ"|makemv name|mvexpand name
|appendcols [|makeresults|eval designation="Manager Clerk"|makemv designation|mvexpand designation]
|appendcols [|makeresults|eval salary="12345 6789"|makemv salary|mvexpand salary]
|eval output="name=".name.",deignation=".designation.",salary=".salary|fields output