Splunk Search

how to extract a value from a field name ?

mah
Builder

Hi,

I have a table like that : 

testtotalproductA_xxxxproductA_zzzzproductB_xxxxproductB_zzzz
1220.230.360.440.55

 

What I want is a table like that :

testtotalobjectxxxxzzzz
122productA0.230.36
122productB0.440.55

 

How can I extract "product" from the name of the field ? 

Can you help me please ?

Thank you !

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It nearly always helps to have a fuller picture! 😀

| makeresults
| eval _raw="test	total	productA_xxxx	productA_zzzz	productB_xxxx	productB_zzzz
1	22	0.23	0.36	0.44	0.55"
| multikv forceheader=1
| fields - _* linecount


| eval testtotal=test."|".total
| fields - test total
| untable testtotal product value
| eval object=mvindex(split(product,"_"),0)
| eval product=mvindex(split(product,"_"),1)
| eval testtotalobject=testtotal."|".object
| xyseries testtotalobject product value
| eval test=mvindex(split(testtotalobject,"|"),0)
| eval total=mvindex(split(testtotalobject,"|"),1)
| eval object=mvindex(split(testtotalobject,"|"),2)
| fields - testtotalobject
| table test total object *

First, combine the common fields, then untable (this is the inverse of xyseries). Now split the product into object and product. Append the object to the common field, and put back into an xyseries. Finally, split out the components of the common field.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="product_xxxx	product_zzzz
0.23	0.36"
| multikv forceheader=1
| fields - _* linecount



| transpose 0
| eval column=mvindex(split(column,"_"),1)
| transpose 0 header_field=column
| fields - column
| eval object="product"
0 Karma

mah
Builder

Hi @ITWhisperer 

I edited my post because it does not suit with my whole table.

Please look at my first post I have just edited.

Thanks a lot! 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It nearly always helps to have a fuller picture! 😀

| makeresults
| eval _raw="test	total	productA_xxxx	productA_zzzz	productB_xxxx	productB_zzzz
1	22	0.23	0.36	0.44	0.55"
| multikv forceheader=1
| fields - _* linecount


| eval testtotal=test."|".total
| fields - test total
| untable testtotal product value
| eval object=mvindex(split(product,"_"),0)
| eval product=mvindex(split(product,"_"),1)
| eval testtotalobject=testtotal."|".object
| xyseries testtotalobject product value
| eval test=mvindex(split(testtotalobject,"|"),0)
| eval total=mvindex(split(testtotalobject,"|"),1)
| eval object=mvindex(split(testtotalobject,"|"),2)
| fields - testtotalobject
| table test total object *

First, combine the common fields, then untable (this is the inverse of xyseries). Now split the product into object and product. Append the object to the common field, and put back into an xyseries. Finally, split out the components of the common field.

mah
Builder

Hi @ITWhisperer 

It is exactly what I needed ! 

Thanks a lot ! 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...