Splunk Search

how to reassign/move values ​​in other fields ?

mah
Builder

Hi,

I have a table like that : 

idnameappenv
123test1[app]:my_app[env]:my_env
456test2[env]:my_env[app]:my_app

 

My issue is  is that the values ​​of the header env and app are mixed ...
How to put [app] values ​​in "app" column and [env] values ​​in "env" column ?

Is this possible ?

Thanks !

Labels (1)
0 Karma
1 Solution

to4kawa
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="id	name	app	env
123	test1	[app]:my_app	[env]:my_env
456	test2	[env]:my_env	[app]:my_app"
| multikv forceheader=1
| table id	name	app	env
| eval tmp=id."#".name
| fields - id name
| untable tmp app env
| rex field=env "\[(?<app>\w+)\]"
| xyseries tmp app env
| rex field=tmp "(?<id>\d+)#(?<name>\w+)"
| table id name app env

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It looks like the data was not onboarded properly.  Specifically, the fields were not parsed correctly so data sometimes ended up in the wrong fields.

Can you share some raw events and the props.conf and transforms.conf settings used to ingest them?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

mah
Builder

it seems I have to improve my script, because raws are formated by the script and directly push in a csv. 

I do not index the csv. I run my script on the Search Head. 

 

 

0 Karma

to4kawa
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="id	name	app	env
123	test1	[app]:my_app	[env]:my_env
456	test2	[env]:my_env	[app]:my_app"
| multikv forceheader=1
| table id	name	app	env
| eval tmp=id."#".name
| fields - id name
| untable tmp app env
| rex field=env "\[(?<app>\w+)\]"
| xyseries tmp app env
| rex field=tmp "(?<id>\d+)#(?<name>\w+)"
| table id name app env

View solution in original post

mah
Builder

Perfect ! 

I did not have the logic to do that. 

Thank a lot !

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!