Splunk Search

Swap field and values

muebel
SplunkTrust
SplunkTrust

I have a list of fields within a Datamodel collected as values within the field named "unknown"

| datamodel Authentication Authentication 
| table * 
| spath 
| table fields{}.displayName 
| rename fields{}.displayName as unknown 
| mvexpand unknown

This gives:
alt text

I'd like to extend this search to give me a table with fields "dest_bunit", "dest_category" etc, all with a value of "unknown"

Ultimately this would be used as a subsearch within tstats to find events that have unknown values for any of the values within the datamodel.

More straightforward (and equally dynamic) would probably serve as an answer to this as well.

Tags (3)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this

| datamodel Authentication Authentication 
 | table * 
 | spath 
 | table fields{}.displayName 
 | rename fields{}.displayName as unknown 
 | mvexpand unknown | eval temp=1 | eval data="unknown" | xyseries temp unknown data | fields - temp

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try like this

| datamodel Authentication Authentication 
 | table * 
 | spath 
 | table fields{}.displayName 
 | rename fields{}.displayName as unknown 
 | mvexpand unknown | eval temp=1 | eval data="unknown" | xyseries temp unknown data | fields - temp

muebel
SplunkTrust
SplunkTrust

I had thought that xyseries and/or untable had something to do with the solution. I need to understand those commands better. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...