topic Re: How to transpose rows of one column into multiple columns? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-transpose-rows-of-one-column-into-multiple-columns/m-p/571465#M199143 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/239822">@cjkar</a>&nbsp;</P><P>I think simple eval can help you on this.&nbsp;Can you please try this with your search?</P><LI-CODE lang="markup">YOUR_SEARCH | eval ENV=mvindex(VALUES,0),APP=mvindex(VALUES,2),LOC=mvindex(VALUES,2)</LI-CODE><P>&nbsp;</P><P><STRONG>My Sample Search :</STRONG></P><LI-CODE lang="markup">| makeresults | eval _raw="hostname,VALUES HOST1,ENV1|APP1|LOC1 HOST2,ENV2|APP2|LOC2" | multikv forceheader=1 | eval VALUES=split(VALUES,"|") | rename comment as "Upto now is for sample data only" | table hostname,VALUES | eval ENV=mvindex(VALUES,0),APP=mvindex(VALUES,2),LOC=mvindex(VALUES,2)</LI-CODE><P><BR />&nbsp;KV</P> Tue, 19 Oct 2021 06:07:34 GMT kamlesh_vaghela 2021-10-19T06:07:34Z How to transpose rows of one column into multiple columns? https://community.splunk.com/t5/Splunk-Search/How-to-transpose-rows-of-one-column-into-multiple-columns/m-p/571464#M199142 <P>I currently have multiple entries in the VALUES column for each host.</P><P>The table currently looks like:&nbsp;</P><TABLE border="1" width="44.44572188510166%"><TBODY><TR><TD width="25%">hostname</TD><TD width="25%">VALUES</TD></TR><TR><TD width="25%">HOST1</TD><TD width="25%"><P>ENV1</P><P>APP1</P><P>LOC1</P><P>&nbsp;</P></TD></TR><TR><TD width="25%">HOST2</TD><TD width="25%"><P>ENV2</P><P>APP2</P><P>LOC2</P></TD></TR></TBODY></TABLE><P>&nbsp;</P><P>I would like the table to read as:</P><TABLE border="1" width="280px"><TBODY><TR><TD width="114.425px">hostname</TD><TD width="62.225px">ENV</TD><TD width="50.825px">APP</TD><TD width="51.525px">LOC</TD></TR><TR><TD width="114.425px">HOST1</TD><TD width="62.225px">ENV1</TD><TD width="50.825px">APP1</TD><TD width="51.525px">LOC1</TD></TR><TR><TD width="114.425px">HOST2</TD><TD width="62.225px"><P>ENV2</P></TD><TD width="50.825px"><P>APP2</P></TD><TD width="51.525px"><P>LOC2</P></TD></TR></TBODY></TABLE><P>&nbsp;</P><P>I am essentially trying to transpose the column "VALUE" and create 3 separate columns with the custom headings "ENV,APP and LOC"&nbsp;</P> Tue, 19 Oct 2021 05:32:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-transpose-rows-of-one-column-into-multiple-columns/m-p/571464#M199142 cjkar 2021-10-19T05:32:54Z Re: How to transpose rows of one column into multiple columns? https://community.splunk.com/t5/Splunk-Search/How-to-transpose-rows-of-one-column-into-multiple-columns/m-p/571465#M199143 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/239822">@cjkar</a>&nbsp;</P><P>I think simple eval can help you on this.&nbsp;Can you please try this with your search?</P><LI-CODE lang="markup">YOUR_SEARCH | eval ENV=mvindex(VALUES,0),APP=mvindex(VALUES,2),LOC=mvindex(VALUES,2)</LI-CODE><P>&nbsp;</P><P><STRONG>My Sample Search :</STRONG></P><LI-CODE lang="markup">| makeresults | eval _raw="hostname,VALUES HOST1,ENV1|APP1|LOC1 HOST2,ENV2|APP2|LOC2" | multikv forceheader=1 | eval VALUES=split(VALUES,"|") | rename comment as "Upto now is for sample data only" | table hostname,VALUES | eval ENV=mvindex(VALUES,0),APP=mvindex(VALUES,2),LOC=mvindex(VALUES,2)</LI-CODE><P><BR />&nbsp;KV</P> Tue, 19 Oct 2021 06:07:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-transpose-rows-of-one-column-into-multiple-columns/m-p/571465#M199143 kamlesh_vaghela 2021-10-19T06:07:34Z Re: How to transpose rows of one column into multiple columns? https://community.splunk.com/t5/Splunk-Search/How-to-transpose-rows-of-one-column-into-multiple-columns/m-p/571566#M199170 <P>Worked perfectly thanks&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/127939">@kamlesh_vaghela</a>&nbsp;!</P> Tue, 19 Oct 2021 23:10:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-transpose-rows-of-one-column-into-multiple-columns/m-p/571566#M199170 cjkar 2021-10-19T23:10:16Z