topic Re: Is there a "zip_longest" like function in Splunk? in Splunk Search

Is there a "zip_longest" like function in Splunk?

iiooiiooiioo — Mon, 08 Jun 2020 21:07:35 GMT

I have this search/report:

host=app-dev-001 terminating OR rehire | convert timeformat="%Y-%m-%d" ctime(_time) AS date | table date rehire term_user

This gives me this result:

I would like to get term_user values to start showing up on row 1.

Is there something like python's zip_longest function?

import itertools
for u1, u2 in itertools.zip_longest(l1, l2):
...    print(u1, u2)
...    
omikusarl ahubshs
chasinnb egathnls
yeanvked mfdhaaar
kkldjuga iuvdcahe
aarehdv swusrbib
vikdho3n rcathrki
None jduakdf
None loidjht

Re: Is there a "zip_longest" like function in Splunk?

to4kawa — Wed, 08 Apr 2020 20:07:38 GMT

host=app-dev-001 rehire 
| convert timeformat="%Y-%m-%d" ctime(_time) AS date 
| table date rehire 
| appendcols [search host=app-dev-001 terminating
| table term_user]
| fillnull rehire term_user value="None"

I don't know zip_longest. how about this?
If there is the key field, you can use stats.

Re: Is there a "zip_longest" like function in Splunk?

iiooiiooiioo — Wed, 08 Apr 2020 20:37:02 GMT

awesome thanks! That's just what I needed.