topic Re: How to combine multiple rows (from sub search results) into different columns on single row (main search) in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-rows-from-sub-search-results-into/m-p/549768#M156017 <P>You can't have duplicate column names. To get the results in one row, try</P><LI-CODE lang="markup">| makeresults | eval _raw="Column1,Column2 A1,A2 B1,B2 C1,C2 D1,D2" | multikv forceheader=1 | table Column1,Column2 | streamstats count as row | foreach * [ eval columnvalues=if("&lt;&lt;FIELD&gt;&gt;"="row",columnvalues,if(isnull(columnvalues),&lt;&lt;FIELD&gt;&gt;,mvappend(columnvalues,&lt;&lt;FIELD&gt;&gt;)))] | fields columnvalues | mvexpand columnvalues | transpose 0 | where column="columnvalues"</LI-CODE> Thu, 29 Apr 2021 07:56:22 GMT ITWhisperer 2021-04-29T07:56:22Z How to combine multiple rows (from sub search results) into different columns on single row (main search) https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-rows-from-sub-search-results-into/m-p/549761#M156013 <DIV class="lia-quilt-row lia-quilt-row-message-subject"><DIV class="lia-quilt-column lia-quilt-column-24 lia-quilt-column-single lia-quilt-column-message-subject-content"><DIV class="lia-quilt-column-alley lia-quilt-column-alley-single"><DIV class="topic-subject-wrapper"><DIV class="lia-message-subject lia-component-message-view-widget-subject">&nbsp;</DIV></DIV></DIV></DIV></DIV><DIV class="lia-quilt-row lia-quilt-row-message-author"><DIV class="lia-quilt-column lia-quilt-column-04 lia-quilt-column-right lia-quilt-column-message-post-times-content"><DIV class="lia-quilt-column-alley lia-quilt-column-alley-right"><DIV class="lia-message-post-date lia-component-post-date lia-component-message-view-widget-post-date"><SPAN>I have a query that returns the following result.</SPAN></DIV></DIV></DIV></DIV><DIV class="lia-quilt-row lia-quilt-row-message-body"><DIV class="lia-quilt-column lia-quilt-column-24 lia-quilt-column-single lia-quilt-column-message-body-content"><DIV class="lia-quilt-column-alley lia-quilt-column-alley-single"><DIV class="lia-message-body lia-component-message-view-widget-body lia-component-body-signature-highlight-escalation lia-component-message-view-widget-body-signature-highlight-escalation"><DIV class="lia-message-body-content"><P>&nbsp;</P><TABLE border="1" width="100%"><TBODY><TR><TD width="50%"><STRONG>Column 1</STRONG></TD><TD width="50%"><STRONG>Column 2</STRONG></TD></TR><TR><TD>A1</TD><TD>A2</TD></TR><TR><TD>B1</TD><TD>B2</TD></TR><TR><TD>C1</TD><TD>C2</TD></TR><TR><TD>D1</TD><TD>D2</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>And I would like to transform it to something like this</P><TABLE border="1" width="99.21875%"><TBODY><TR><TD width="14.062500000000002%" height="25px"><STRONG>1st&nbsp; row</STRONG></TD><TD width="11.588541666666659%" height="25px"><STRONG>1st row</STRONG></TD><TD width="12.63020833333333%" height="25px"><STRONG>2nd row</STRONG></TD><TD width="13.151041666666668%" height="25px"><STRONG>&nbsp;2nd row</STRONG></TD><TD width="11.458333333333332%" height="25px"><STRONG>3 rd row&nbsp;</STRONG></TD><TD width="10.026041666666668%" height="25px"><STRONG>3rd row</STRONG></TD><TD width="10.807291666666668%" height="25px"><STRONG>4th row</STRONG></TD><TD width="15.494791666666666%" height="25px"><STRONG>4th row</STRONG></TD></TR><TR><TD width="14.062500000000002%" height="25px">A1</TD><TD width="11.588541666666659%" height="25px">A2</TD><TD width="12.63020833333333%" height="25px">B1</TD><TD width="13.151041666666668%" height="25px">B2</TD><TD width="11.458333333333332%" height="25px">&nbsp;C1</TD><TD width="10.026041666666668%" height="25px">&nbsp;C2</TD><TD width="10.807291666666668%" height="25px">&nbsp;D1</TD><TD width="15.494791666666666%" height="25px">&nbsp;D2</TD></TR></TBODY></TABLE><P>&nbsp;</P></DIV></DIV></DIV></DIV></DIV><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">| makeresults | eval _raw="Column1,Column2 A1,A2 B1,B2 C1,C2 D1,D2" | multikv forceheader=1 | table Column1,Column2 |.......</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Thu, 29 Apr 2021 07:40:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-rows-from-sub-search-results-into/m-p/549761#M156013 Raymond2T 2021-04-29T07:40:25Z Re: How to combine multiple rows (from sub search results) into different columns on single row (main search) https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-rows-from-sub-search-results-into/m-p/549768#M156017 <P>You can't have duplicate column names. To get the results in one row, try</P><LI-CODE lang="markup">| makeresults | eval _raw="Column1,Column2 A1,A2 B1,B2 C1,C2 D1,D2" | multikv forceheader=1 | table Column1,Column2 | streamstats count as row | foreach * [ eval columnvalues=if("&lt;&lt;FIELD&gt;&gt;"="row",columnvalues,if(isnull(columnvalues),&lt;&lt;FIELD&gt;&gt;,mvappend(columnvalues,&lt;&lt;FIELD&gt;&gt;)))] | fields columnvalues | mvexpand columnvalues | transpose 0 | where column="columnvalues"</LI-CODE> Thu, 29 Apr 2021 07:56:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-rows-from-sub-search-results-into/m-p/549768#M156017 ITWhisperer 2021-04-29T07:56:22Z Re: How to combine multiple rows (from sub search results) into different columns on single row (main search) https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-rows-from-sub-search-results-into/m-p/549798#M156038 <P>Thank you so much. It is good solution&nbsp;&nbsp;</P> Thu, 29 Apr 2021 09:59:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-rows-from-sub-search-results-into/m-p/549798#M156038 Raymond2T 2021-04-29T09:59:55Z