Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to separate fields into events based on value

$
0
0
Hi all I've been trying to separate the values of a stats table that looks similar to what i have below. I've used different variations of the mvexpand command, however, the problem I face when I try this is that each one of my "Bundle" fields has multiple bundles of the same value combined into the same value (which I count and do calculations to in the background), I.E three 36.56.66.76 are displayed as one field instead of three, but when I try separating them (for export as a csv) it gives me every individual value instead of keeping everything the way it is, and just making new fields with it. Is there any way I can do this? Thank you. ( P.S the fields would be named Bundle, MM ,and Installs , respectively) Bundle MM Installs 36.46.56.76 32 3 37.47.57.77 33 4 38.48.58.78 40 7 Desired Results- ( where each ----------------- means a new event) Bundle MM Installs ---------------------------------------------- 36.46.56.76 32 3 ---------------------------------------------- 37.47.57.77 33 4 ---------------------------------------------- 38.48.58.78 40 7

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>