Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Build table by char position in string

$
0
0
Hi, I´ve got this event ->> 2020/02/14/16:12:28:872> MachineNumber="K003991_HT"> Pass="FPPPPPPFPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP" Each position of the pass value gives an pass or fail for one position (1..80 but can also be only 1..45). For example Pass="FPPF" says -> Position_1 = Fail Position_2 = Pass Position_3 = Pass Position_4 = Fail Now I want to buld an table to show which position has how much fails of all events. How to do this? One possibility could be to use mvexpand and build more events. For example, build from this ->> 2020/02/14/16:12:28:872 MachineNumber="K003991_HT" Pass="FPPF" that events ->> 2020/02/14/16:12:28:872 MachineNumber="K003991_HT" Pass="Fail" Position="1"> 2020/02/14/16:12:28:872 MachineNumber="K003991_HT" Pass="Pass" Position="2"> 2020/02/14/16:12:28:872 MachineNumber="K003991_HT" Pass="Pass" Position="3"> 2020/02/14/16:12:28:872 MachineNumber="K003991_HT" Pass="Fail" Position="4" ...but how is it possible do do this? Or is there an other possibility to buld my table? Thanks!

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>