https://community.splunk.com/t5/Splunk-Search/How-to-break-down-multiple-values-into-new-columns-dynamically/m-p/596219#M207549 <P>I have column with Multiple Values separated by new line character</P> <P>Type is the column</P> <P>&nbsp;ID&nbsp;&nbsp;&nbsp;&nbsp; Type</P> <P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Type_A</P> <P>01 &nbsp;&nbsp;&nbsp; Type_B</P> <P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Type_C</P> <P>I need new columns with values 1 or 0 for row (with ID 01) based on its presence for Type</P> <P>ID &nbsp; &nbsp; &nbsp; Type&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Type_A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Type_B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Type_C</P> <P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Type_A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P> <P>01 &nbsp;&nbsp;&nbsp;&nbsp; Type_B</P> <P>&nbsp;</P> <P>02&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Type_A</P> <P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Type_B</P> <P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Type_C</P> Tue, 03 May 2022 16:01:25 GMT vijay_k 2022-05-03T16:01:25Z https://community.splunk.com/t5/Splunk-Search/How-to-break-down-multiple-values-into-new-columns-dynamically/m-p/596219#M207549 <P>I have column with Multiple Values separated by new line character</P> <P>Type is the column</P> <P>&nbsp;ID&nbsp;&nbsp;&nbsp;&nbsp; Type</P> <P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Type_A</P> <P>01 &nbsp;&nbsp;&nbsp; Type_B</P> <P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Type_C</P> <P>I need new columns with values 1 or 0 for row (with ID 01) based on its presence for Type</P> <P>ID &nbsp; &nbsp; &nbsp; Type&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Type_A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Type_B&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Type_C</P> <P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Type_A&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0</P> <P>01 &nbsp;&nbsp;&nbsp;&nbsp; Type_B</P> <P>&nbsp;</P> <P>02&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Type_A</P> <P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Type_B</P> <P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Type_C</P> Tue, 03 May 2022 16:01:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-break-down-multiple-values-into-new-columns-dynamically/m-p/596219#M207549 vijay_k 2022-05-03T16:01:25Z https://community.splunk.com/t5/Splunk-Search/How-to-break-down-multiple-values-into-new-columns-dynamically/m-p/596223#M207553 <LI-CODE lang="markup">| eval Type=split(Type," ") | chart count by ID Type</LI-CODE> Tue, 03 May 2022 08:31:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-break-down-multiple-values-into-new-columns-dynamically/m-p/596223#M207553 ITWhisperer 2022-05-03T08:31:47Z