Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Is it possible to split lines and re-use certain fields?

$
0
0
I have thise event: ID=FAKE_ID_NAME,TS=1570441680,F1=1380,F2=60,F3=60,F4=1500 For my analysis it would be very usefull to get every field to a new line except ID and TS, so the desired output is: ID=FAKE_ID_NAME,TS=1570441680,F1=1380; ID=FAKE_ID_NAME,TS=1570441680,F2=60; ID=FAKE_ID_NAME,TS=1570441680,F3=60; ID=FAKE_ID_NAME,TS=1570441680,F4=1500; How can I achieve this?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>