<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Dynamic Names and Table Pivot: How can I get the following output? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Dynamic-Names-and-Table-Pivot-How-can-I-get-the-following-output/m-p/447613#M77835</link>
    <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;I have a single CSV source where the columns names are not fixed as well as the number of the columns. A simple search returns the following:&lt;/P&gt;

&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/5723iACDEFF2F40C14741/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;The number and the letter after the string PhysicalDisk is variable. I'm calculating the avg() and perc95() for each value.&lt;/P&gt;

&lt;P&gt;How can I get the following output from this source, where the Instance is part of the original field name?&lt;/P&gt;

&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/5724iCE7872EDEAC90139/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
    <pubDate>Mon, 10 Sep 2018 15:36:40 GMT</pubDate>
    <dc:creator>tamakg</dc:creator>
    <dc:date>2018-09-10T15:36:40Z</dc:date>
    <item>
      <title>Dynamic Names and Table Pivot: How can I get the following output?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Dynamic-Names-and-Table-Pivot-How-can-I-get-the-following-output/m-p/447613#M77835</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;I have a single CSV source where the columns names are not fixed as well as the number of the columns. A simple search returns the following:&lt;/P&gt;

&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/5723iACDEFF2F40C14741/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;The number and the letter after the string PhysicalDisk is variable. I'm calculating the avg() and perc95() for each value.&lt;/P&gt;

&lt;P&gt;How can I get the following output from this source, where the Instance is part of the original field name?&lt;/P&gt;

&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/5724iCE7872EDEAC90139/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 10 Sep 2018 15:36:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Dynamic-Names-and-Table-Pivot-How-can-I-get-the-following-output/m-p/447613#M77835</guid>
      <dc:creator>tamakg</dc:creator>
      <dc:date>2018-09-10T15:36:40Z</dc:date>
    </item>
  </channel>
</rss>

