Splunk Search

how to extract a value from a field name ?

mah
Builder

Hi,

I have a table like that : 

testtotalproductA_xxxxproductA_zzzzproductB_xxxxproductB_zzzz
1220.230.360.440.55

 

What I want is a table like that :

testtotalobjectxxxxzzzz
122productA0.230.36
122productB0.440.55

 

How can I extract "product" from the name of the field ? 

Can you help me please ?

Thank you !

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It nearly always helps to have a fuller picture! 😀

| makeresults
| eval _raw="test	total	productA_xxxx	productA_zzzz	productB_xxxx	productB_zzzz
1	22	0.23	0.36	0.44	0.55"
| multikv forceheader=1
| fields - _* linecount


| eval testtotal=test."|".total
| fields - test total
| untable testtotal product value
| eval object=mvindex(split(product,"_"),0)
| eval product=mvindex(split(product,"_"),1)
| eval testtotalobject=testtotal."|".object
| xyseries testtotalobject product value
| eval test=mvindex(split(testtotalobject,"|"),0)
| eval total=mvindex(split(testtotalobject,"|"),1)
| eval object=mvindex(split(testtotalobject,"|"),2)
| fields - testtotalobject
| table test total object *

First, combine the common fields, then untable (this is the inverse of xyseries). Now split the product into object and product. Append the object to the common field, and put back into an xyseries. Finally, split out the components of the common field.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="product_xxxx	product_zzzz
0.23	0.36"
| multikv forceheader=1
| fields - _* linecount



| transpose 0
| eval column=mvindex(split(column,"_"),1)
| transpose 0 header_field=column
| fields - column
| eval object="product"
0 Karma

mah
Builder

Hi @ITWhisperer 

I edited my post because it does not suit with my whole table.

Please look at my first post I have just edited.

Thanks a lot! 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It nearly always helps to have a fuller picture! 😀

| makeresults
| eval _raw="test	total	productA_xxxx	productA_zzzz	productB_xxxx	productB_zzzz
1	22	0.23	0.36	0.44	0.55"
| multikv forceheader=1
| fields - _* linecount


| eval testtotal=test."|".total
| fields - test total
| untable testtotal product value
| eval object=mvindex(split(product,"_"),0)
| eval product=mvindex(split(product,"_"),1)
| eval testtotalobject=testtotal."|".object
| xyseries testtotalobject product value
| eval test=mvindex(split(testtotalobject,"|"),0)
| eval total=mvindex(split(testtotalobject,"|"),1)
| eval object=mvindex(split(testtotalobject,"|"),2)
| fields - testtotalobject
| table test total object *

First, combine the common fields, then untable (this is the inverse of xyseries). Now split the product into object and product. Append the object to the common field, and put back into an xyseries. Finally, split out the components of the common field.

mah
Builder

Hi @ITWhisperer 

It is exactly what I needed ! 

Thanks a lot ! 

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...