topic Format or Splitup a row of data ito three rows for reporting in Splunk Search

Format or Splitup a row of data ito three rows for reporting

hartfoml — Fri, 10 Jul 2015 19:51:35 GMT

I am doing a search from two databases and comparing data from both. I am using the appenccols command to get the data from both databases in one row so that I can do math on the data like this.

this gives me a table
db1_count notindb1 db2count notinbd2 db1_total db2_total confidence 126 126 236 15 252 251 99.60%

I would like to split up the one row to look like this:

database_name count notindb total db1 126 126 252 db2 236 15 251 confidence 99.60%

Any suggestions would be appreciated

Re: Format or Splitup a row of data ito three rows for reporting

woodcock — Sat, 11 Jul 2015 00:09:14 GMT

If you specify what field are coming out of each table (even better would be a sample row from each table) and if there is one field you would like to use to join, I will try to help. As it is, I do not understand how you are trying to merge.

Re: Format or Splitup a row of data ito three rows for reporting

rsennett_splunk — Tue, 29 Sep 2020 06:39:45 GMT

I'm answering based on what you've shown us. But the question says :"Format or Splitup a row of data into three rows for reporting" however your example shows the resulting row and a single row of what you'd like it to look like...

if that's not what you meant to show, please add details to your question. (do not add a comment with detail, edit the question)

That said...

What you're producing here is a "dataset" that you can then continue to manipulate. the fact that it's coming from the db queries and the join is really irrelevant.

From your example, it looks like you want to continue your search with a pipe and merge the notindbX fields and the dbX_count fields while re-ordering the others. (you don't seem to have the database_name field so you will have to add that to the initial search)
Why would you not just merge the fields (From your example, it looks like you want to continue your search with a pipe and merge the notindbX fields and the dbX_count fields while re-ordering the others. (you don't seem to have the database_name field. Why would you not just merge the fields ([https://answers.splunk.com/answers/49394/merge-two-fields-into-one-field.html][1])
and then continue with |table ....