<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to split a column of results into two? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-split-a-column-of-results-into-two/m-p/392196#M70047</link>
    <description>&lt;P&gt;SPOT ON! I understand that including the search would be more helpful but unfortunately every field is a proprietary field and would take way to long to mask. But even without the search added your syntax in the proper placement and it was like magic! thank you ...&lt;/P&gt;

&lt;P&gt;the only issue now is that the two percentage rows are showing up separate ( still a row for weighted % and one for unweighted) but i can deal with that it seems as that is due to my search and eval commands building those two fields separately. &lt;/P&gt;</description>
    <pubDate>Thu, 14 Jun 2018 18:02:08 GMT</pubDate>
    <dc:creator>masonwhite</dc:creator>
    <dc:date>2018-06-14T18:02:08Z</dc:date>
    <item>
      <title>How to split a column of results into two?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-split-a-column-of-results-into-two/m-p/392194#M70045</link>
      <description>&lt;P&gt;I have the following table and i wish to split the data to two columns one weighted one not:&lt;BR /&gt;
all of these fields are generated through eval commands the only actual field is the "headcountestimate" therefore a simple lookup or appedcols wouldn't do. Any commands come to mind?&lt;BR /&gt;
current table:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;column  -------------------------------------------------------row 1
Total Estimated Headcount   ---------------------------###
Total Actual Headcount Needed   --------------------####
Total Overestimated Headcount   --------------------###
% Overestimated Headcount   ------------------------%%%
Weighted Total Estimated Headcount  -------------###
Weighted Total Actual Headcount Needed-------###
Weighted Total Overestimated Headcount-------####
Weighted % Overestimated Headcount  ----------%%%
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Would like : &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;Column1----------------------------------------------------Weighted -------------------------------------------------------Unweighted
Estimated Headcount ----------------------------------------###-------------------------------------------------------------###
Actual Headcount Needed ----------------------------------####-----------------------------------------------------------###
Overestimated Headcount ----------------------------------###------------------------------------------------------------###
%Overestimated Headcount    -------------------------------%%%-------------------------------------------------------%%%
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Thu, 14 Jun 2018 15:12:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-split-a-column-of-results-into-two/m-p/392194#M70045</guid>
      <dc:creator>masonwhite</dc:creator>
      <dc:date>2018-06-14T15:12:13Z</dc:date>
    </item>
    <item>
      <title>Re: How to split a column of results into two?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-split-a-column-of-results-into-two/m-p/392195#M70046</link>
      <description>&lt;P&gt;Your current table looks like output of transpose command. There may be a better answer if you could share you full search. &lt;/P&gt;

&lt;P&gt;With that not available, try something like this&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;your current search giving fields 'column' 'row 1'
| eval type=if(like(column,"Weighted%"),"Weighted","Unweighted")
| eval column=replace(column,"^.*Total (.+)","\1")
| chart values("row 1") over column by type
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Thu, 14 Jun 2018 16:18:30 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-split-a-column-of-results-into-two/m-p/392195#M70046</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2018-06-14T16:18:30Z</dc:date>
    </item>
    <item>
      <title>Re: How to split a column of results into two?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-split-a-column-of-results-into-two/m-p/392196#M70047</link>
      <description>&lt;P&gt;SPOT ON! I understand that including the search would be more helpful but unfortunately every field is a proprietary field and would take way to long to mask. But even without the search added your syntax in the proper placement and it was like magic! thank you ...&lt;/P&gt;

&lt;P&gt;the only issue now is that the two percentage rows are showing up separate ( still a row for weighted % and one for unweighted) but i can deal with that it seems as that is due to my search and eval commands building those two fields separately. &lt;/P&gt;</description>
      <pubDate>Thu, 14 Jun 2018 18:02:08 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-split-a-column-of-results-into-two/m-p/392196#M70047</guid>
      <dc:creator>masonwhite</dc:creator>
      <dc:date>2018-06-14T18:02:08Z</dc:date>
    </item>
    <item>
      <title>Re: How to split a column of results into two?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-split-a-column-of-results-into-two/m-p/392197#M70048</link>
      <description>&lt;P&gt;Replace &lt;CODE&gt;eval column...&lt;/CODE&gt; in above query with this&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; | eval column=replace(column,"^(Total |Weighted Total |Weighted )*(.+)","\2")
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Thu, 14 Jun 2018 18:39:19 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-split-a-column-of-results-into-two/m-p/392197#M70048</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2018-06-14T18:39:19Z</dc:date>
    </item>
    <item>
      <title>Re: How to split a column of results into two?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-split-a-column-of-results-into-two/m-p/392198#M70049</link>
      <description>&lt;P&gt;Nice! This fixed it. you are awesome !&lt;/P&gt;</description>
      <pubDate>Thu, 14 Jun 2018 19:15:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-split-a-column-of-results-into-two/m-p/392198#M70049</guid>
      <dc:creator>masonwhite</dc:creator>
      <dc:date>2018-06-14T19:15:47Z</dc:date>
    </item>
  </channel>
</rss>

