topic Re: Convert single row values to multiple rows in Splunk Search

Convert single row values to multiple rows

srinathd — Thu, 30 Oct 2014 13:18:26 GMT

Hi Srinath,

Srinath     USER1   IND0010001
              USER2     IND0010002
              USER3     IND0010003

how to convert above single row values to seperate rows like below

Srinath USER1 IND0010001

Srinath USER2 IND0010002

Srinath USER3 IND0010003

Thanks,
Srinath

Re: Convert single row values to multiple rows

lguinn2 — Thu, 30 Oct 2014 13:39:33 GMT

How did you get the results that you are showing? What was the original search string? What does the data look like? Without this information, I don't think the community can help much.

Re: Convert single row values to multiple rows

srinathd — Mon, 28 Sep 2020 18:02:43 GMT

This is the search quiery

index=test sourcetype=testuser | makemv delim="\xFD" APPLICATION | makemv delim="\xFD" COMPANY | makemv delim="\xFD" FUNCTION | stats list(APPLICATION) as application, list(COMPANY_RESTR) as company, list(FUNCTION) as function by USER_NAME

Re: Convert single row values to multiple rows

somesoni2 — Thu, 30 Oct 2014 14:33:52 GMT

Try this

index=test sourcetype=testuser | makemv delim="xFD" APPLICATION | makemv delim="xFD" COMPANY | makemv delim="xFD" FUNCTION | stats list(APPLICATION) as application, list(COMPANY_RESTR) as company, list(FUNCTION) as function by USER_NAME | eval temp=mvzip(mvzip(application,company,"#"),function,"#") | mvexpand temp | rex field=temp "(?<application>.*)#(?<company>.*)#(?<function>.*)" | fields - temp

Re: Convert single row values to multiple rows

srinathd — Thu, 30 Oct 2014 15:18:47 GMT

Thanks a lot.. it is working well

Re: Convert single row values to multiple rows

srinathd — Thu, 30 Oct 2014 15:37:23 GMT

It is fetching the first record for each user if any of the field which is used in the mvzip is null otherwise it is fetching all the records. It is working well if all the values present.

Re: Convert single row values to multiple rows

crepantherx — Sun, 16 May 2021 02:53:36 GMT

I also need to do this..... would you please explain me the code I didn't understood. What is APPLICATION, FUNCTION... and USER_NAME here ? and how does it works