Splunk Search

how to reassign/move values ​​in other fields ?

mah
Builder

Hi,

I have a table like that : 

idnameappenv
123test1[app]:my_app[env]:my_env
456test2[env]:my_env[app]:my_app

 

My issue is  is that the values ​​of the header env and app are mixed ...
How to put [app] values ​​in "app" column and [env] values ​​in "env" column ?

Is this possible ?

Thanks !

Labels (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults
| eval _raw="id	name	app	env
123	test1	[app]:my_app	[env]:my_env
456	test2	[env]:my_env	[app]:my_app"
| multikv forceheader=1
| table id	name	app	env
| eval tmp=id."#".name
| fields - id name
| untable tmp app env
| rex field=env "\[(?<app>\w+)\]"
| xyseries tmp app env
| rex field=tmp "(?<id>\d+)#(?<name>\w+)"
| table id name app env

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It looks like the data was not onboarded properly.  Specifically, the fields were not parsed correctly so data sometimes ended up in the wrong fields.

Can you share some raw events and the props.conf and transforms.conf settings used to ingest them?

---
If this reply helps you, Karma would be appreciated.
0 Karma

mah
Builder

it seems I have to improve my script, because raws are formated by the script and directly push in a csv. 

I do not index the csv. I run my script on the Search Head. 

 

 

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval _raw="id	name	app	env
123	test1	[app]:my_app	[env]:my_env
456	test2	[env]:my_env	[app]:my_app"
| multikv forceheader=1
| table id	name	app	env
| eval tmp=id."#".name
| fields - id name
| untable tmp app env
| rex field=env "\[(?<app>\w+)\]"
| xyseries tmp app env
| rex field=tmp "(?<id>\d+)#(?<name>\w+)"
| table id name app env

mah
Builder

Perfect ! 

I did not have the logic to do that. 

Thank a lot !

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...