Splunk Search

how to extract a value from a field name ?

mah
Builder

Hi,

I have a table like that : 

testtotalproductA_xxxxproductA_zzzzproductB_xxxxproductB_zzzz
1220.230.360.440.55

 

What I want is a table like that :

testtotalobjectxxxxzzzz
122productA0.230.36
122productB0.440.55

 

How can I extract "product" from the name of the field ? 

Can you help me please ?

Thank you !

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It nearly always helps to have a fuller picture! 😀

| makeresults
| eval _raw="test	total	productA_xxxx	productA_zzzz	productB_xxxx	productB_zzzz
1	22	0.23	0.36	0.44	0.55"
| multikv forceheader=1
| fields - _* linecount


| eval testtotal=test."|".total
| fields - test total
| untable testtotal product value
| eval object=mvindex(split(product,"_"),0)
| eval product=mvindex(split(product,"_"),1)
| eval testtotalobject=testtotal."|".object
| xyseries testtotalobject product value
| eval test=mvindex(split(testtotalobject,"|"),0)
| eval total=mvindex(split(testtotalobject,"|"),1)
| eval object=mvindex(split(testtotalobject,"|"),2)
| fields - testtotalobject
| table test total object *

First, combine the common fields, then untable (this is the inverse of xyseries). Now split the product into object and product. Append the object to the common field, and put back into an xyseries. Finally, split out the components of the common field.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="product_xxxx	product_zzzz
0.23	0.36"
| multikv forceheader=1
| fields - _* linecount



| transpose 0
| eval column=mvindex(split(column,"_"),1)
| transpose 0 header_field=column
| fields - column
| eval object="product"
0 Karma

mah
Builder

Hi @ITWhisperer 

I edited my post because it does not suit with my whole table.

Please look at my first post I have just edited.

Thanks a lot! 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It nearly always helps to have a fuller picture! 😀

| makeresults
| eval _raw="test	total	productA_xxxx	productA_zzzz	productB_xxxx	productB_zzzz
1	22	0.23	0.36	0.44	0.55"
| multikv forceheader=1
| fields - _* linecount


| eval testtotal=test."|".total
| fields - test total
| untable testtotal product value
| eval object=mvindex(split(product,"_"),0)
| eval product=mvindex(split(product,"_"),1)
| eval testtotalobject=testtotal."|".object
| xyseries testtotalobject product value
| eval test=mvindex(split(testtotalobject,"|"),0)
| eval total=mvindex(split(testtotalobject,"|"),1)
| eval object=mvindex(split(testtotalobject,"|"),2)
| fields - testtotalobject
| table test total object *

First, combine the common fields, then untable (this is the inverse of xyseries). Now split the product into object and product. Append the object to the common field, and put back into an xyseries. Finally, split out the components of the common field.

mah
Builder

Hi @ITWhisperer 

It is exactly what I needed ! 

Thanks a lot ! 

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...