Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to expand events that contain multivalue fields into separate events with unique field value pairs?

$
0
0
Data event 1.event_id=1 name=x,y,z responsetime=4,5,6 2.event_id=2 name=a,b,c responsetime=7,8,9 I need something like this events 1.event_id=1 name=x responsetime=4 2.event_id=2 name=y responsetime=5 3.event_id=3 name=z responsetime=6 4.event_id=4 name=a responsetime=7 5.event_id=5 name=x responsetime=8 6.event_id=6 name=x responsetime=9 taking out the unique event_id and making multiple rows

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>