Getting Data In

Build table by char position in string

ea7777777
New Member

Hi,

I´ve got this event ->

2020/02/14/16:12:28:872
MachineNumber="K003991_HT"
Pass="FPPPPPPFPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP"

Each position of the pass value gives an pass or fail for one position (1..80 but can also be only 1..45).

For example Pass="FPPF" says ->

Position_1 = Fail
Position_2 = Pass
Position_3 = Pass
Position_4 = Fail

Now I want to buld an table to show which position has how much fails of all events. How to do this?

One possibility could be to use mvexpand and build more events.

For example, build from this ->

2020/02/14/16:12:28:872 MachineNumber="K003991_HT" Pass="FPPF"

that events ->

2020/02/14/16:12:28:872 MachineNumber="K003991_HT" Pass="Fail" Position="1"
2020/02/14/16:12:28:872 MachineNumber="K003991_HT" Pass="Pass" Position="2"
2020/02/14/16:12:28:872 MachineNumber="K003991_HT" Pass="Pass" Position="3"
2020/02/14/16:12:28:872 MachineNumber="K003991_HT" Pass="Fail" Position="4"

...but how is it possible do do this? Or is there an other possibility to buld my table? Thanks!

0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults 
| eval _raw="2020/02/14/16:12:28:872
MachineNumber=\"K003991_HT\"
Pass=\"FPPPPPPFPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP\""
| rex "(?<time>^\S+)"
| eval _time=strptime(time,"%Y/%m/%d/%T.%3Q")
| kv
| table _time MachineNumber Pass
| eval Pass=split(Pass,"")
| mvexpand Pass
| streamstats count as Position

Hi, folks
The detail:

  1. kv extracts key=value
  2. split() makes multivalue.
  3. mvexpand creates events from multivalue.
  4. streamstats makes count named Position.

View solution in original post

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="2020/02/14/16:12:28:872
MachineNumber=\"K003991_HT\"
Pass=\"FPPPPPPFPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP\""
| rex "(?<time>^\S+)"
| eval _time=strptime(time,"%Y/%m/%d/%T.%3Q")
| kv
| table _time MachineNumber Pass
| eval Pass=split(Pass,"")
| mvexpand Pass
| streamstats count as Position

Hi, folks
The detail:

  1. kv extracts key=value
  2. split() makes multivalue.
  3. mvexpand creates events from multivalue.
  4. streamstats makes count named Position.
0 Karma

ea7777777
New Member

Works fine! Thanks!

Only change from my side was ->

 | streamstats count as Position by _time
0 Karma

niketn
Legend

@ea7777777 try the following run anywhere example based on the sample data provided. Commands till | fields _raw generate data, you can pipe the command from | eval ... and validate the output with your query.

| makeresults
| eval _raw="2020/02/14/16:12:28:872 MachineNumber=\"K003991_HT\" Pass=\"FPPF\""
| KV
| fields - _raw
| eval Pass=replace(replace(Pass,"(\w{1})","\1,"),",$","")
| makemv Pass delim=","
| mvexpand Pass
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...