Splunk Search

how to extract a value from a field name ?

mah
Contributor

Hi,

I have a table like that : 

testtotalproductA_xxxxproductA_zzzzproductB_xxxxproductB_zzzz
1220.230.360.440.55

 

What I want is a table like that :

testtotalobjectxxxxzzzz
122productA0.230.36
122productB0.440.55

 

How can I extract "product" from the name of the field ? 

Can you help me please ?

Thank you !

Labels (1)
0 Karma
1 Solution

ITWhisperer
Ultra Champion

It nearly always helps to have a fuller picture! 😀

| makeresults
| eval _raw="test	total	productA_xxxx	productA_zzzz	productB_xxxx	productB_zzzz
1	22	0.23	0.36	0.44	0.55"
| multikv forceheader=1
| fields - _* linecount


| eval testtotal=test."|".total
| fields - test total
| untable testtotal product value
| eval object=mvindex(split(product,"_"),0)
| eval product=mvindex(split(product,"_"),1)
| eval testtotalobject=testtotal."|".object
| xyseries testtotalobject product value
| eval test=mvindex(split(testtotalobject,"|"),0)
| eval total=mvindex(split(testtotalobject,"|"),1)
| eval object=mvindex(split(testtotalobject,"|"),2)
| fields - testtotalobject
| table test total object *

First, combine the common fields, then untable (this is the inverse of xyseries). Now split the product into object and product. Append the object to the common field, and put back into an xyseries. Finally, split out the components of the common field.

View solution in original post

ITWhisperer
Ultra Champion
| makeresults
| eval _raw="product_xxxx	product_zzzz
0.23	0.36"
| multikv forceheader=1
| fields - _* linecount



| transpose 0
| eval column=mvindex(split(column,"_"),1)
| transpose 0 header_field=column
| fields - column
| eval object="product"
0 Karma

mah
Contributor

Hi @ITWhisperer 

I edited my post because it does not suit with my whole table.

Please look at my first post I have just edited.

Thanks a lot! 

0 Karma

ITWhisperer
Ultra Champion

It nearly always helps to have a fuller picture! 😀

| makeresults
| eval _raw="test	total	productA_xxxx	productA_zzzz	productB_xxxx	productB_zzzz
1	22	0.23	0.36	0.44	0.55"
| multikv forceheader=1
| fields - _* linecount


| eval testtotal=test."|".total
| fields - test total
| untable testtotal product value
| eval object=mvindex(split(product,"_"),0)
| eval product=mvindex(split(product,"_"),1)
| eval testtotalobject=testtotal."|".object
| xyseries testtotalobject product value
| eval test=mvindex(split(testtotalobject,"|"),0)
| eval total=mvindex(split(testtotalobject,"|"),1)
| eval object=mvindex(split(testtotalobject,"|"),2)
| fields - testtotalobject
| table test total object *

First, combine the common fields, then untable (this is the inverse of xyseries). Now split the product into object and product. Append the object to the common field, and put back into an xyseries. Finally, split out the components of the common field.

View solution in original post

mah
Contributor

Hi @ITWhisperer 

It is exactly what I needed ! 

Thanks a lot ! 

0 Karma