Splunk Search

how to reassign/move values ​​in other fields ?

mah
Builder

Hi,

I have a table like that : 

idnameappenv
123test1[app]:my_app[env]:my_env
456test2[env]:my_env[app]:my_app

 

My issue is  is that the values ​​of the header env and app are mixed ...
How to put [app] values ​​in "app" column and [env] values ​​in "env" column ?

Is this possible ?

Thanks !

Labels (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults
| eval _raw="id	name	app	env
123	test1	[app]:my_app	[env]:my_env
456	test2	[env]:my_env	[app]:my_app"
| multikv forceheader=1
| table id	name	app	env
| eval tmp=id."#".name
| fields - id name
| untable tmp app env
| rex field=env "\[(?<app>\w+)\]"
| xyseries tmp app env
| rex field=tmp "(?<id>\d+)#(?<name>\w+)"
| table id name app env

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It looks like the data was not onboarded properly.  Specifically, the fields were not parsed correctly so data sometimes ended up in the wrong fields.

Can you share some raw events and the props.conf and transforms.conf settings used to ingest them?

---
If this reply helps you, Karma would be appreciated.
0 Karma

mah
Builder

it seems I have to improve my script, because raws are formated by the script and directly push in a csv. 

I do not index the csv. I run my script on the Search Head. 

 

 

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval _raw="id	name	app	env
123	test1	[app]:my_app	[env]:my_env
456	test2	[env]:my_env	[app]:my_app"
| multikv forceheader=1
| table id	name	app	env
| eval tmp=id."#".name
| fields - id name
| untable tmp app env
| rex field=env "\[(?<app>\w+)\]"
| xyseries tmp app env
| rex field=tmp "(?<id>\d+)#(?<name>\w+)"
| table id name app env

mah
Builder

Perfect ! 

I did not have the logic to do that. 

Thank a lot !

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...