topic Re: TRANSFORMING TABLE in Splunk Search

TRANSFORMING TABLE

nkankur — Thu, 08 Mar 2018 10:20:40 GMT

I have data as given below in table format
A B C D E F
517 2498 186 1000 250 100
399 314 1559 100 100 1000

I want each row of D E and F against each row of A B and C kind of cross transformation
output should look like this:
A B C D E F
517 2498 186 1000 250 100
517 2498 186 100 100 1000
399 314 1559 1000 250 100
399 314 1559 100 100 1000

Thanks in advance!

Re: TRANSFORMING TABLE

Richfez — Thu, 08 Mar 2018 13:38:46 GMT

If I'm reading that correctly, any answer you get here has the distinct possibility that it will make your Splunk servers start sobbing uncontrollably.

In your two original events, you see you end up with four results.
If you repeated with three original events, you would end up with nine.
Four would end up sixteen...

By the time you a few hundred events, you might start having problems.

BUT this is OK, I just wanted to be clear about possible side effects and be sure that you know what you are asking?

Re: TRANSFORMING TABLE

valiquet — Fri, 09 Mar 2018 08:40:33 GMT

| eval row=A.B.C.D.F.",".A.B.C.D.F
| makemv delim="," row
| mvexpand row

Re: TRANSFORMING TABLE

nkankur — Mon, 12 Mar 2018 11:30:10 GMT

Hi,

I understood your point. But actually, my original data has fixed and fewer events hence this kind of issue is not going to affect my splunk servers. 🙂

Re: TRANSFORMING TABLE

nkankur — Mon, 12 Mar 2018 11:31:00 GMT

Thanks for your response, but this is not giving me required results.

Re: TRANSFORMING TABLE

Richfez — Mon, 12 Mar 2018 11:45:35 GMT

Great! Some folks don't always think everything through to the end, so I'm glad you have already done so!

(And sometimes it's worth noting specifically so someone else with unbounded results might be forewarned just a bit that they'll have to use care with this solution... 🙂 )

Happy Splunking!