<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Expanding rows to certain number of rows in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Expanding-rows-to-certain-number-of-rows/m-p/123614#M33384</link>
    <description>&lt;P&gt;Append this to your search:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;... | eval temp = replace(tostring(pow(10, count-1)), "(\d)", "\1,") | makemv temp delim="," | mvexpand temp | fields - temp
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Thu, 31 Oct 2013 13:26:53 GMT</pubDate>
    <dc:creator>martin_mueller</dc:creator>
    <dc:date>2013-10-31T13:26:53Z</dc:date>
    <item>
      <title>Expanding rows to certain number of rows</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Expanding-rows-to-certain-number-of-rows/m-p/123613#M33383</link>
      <description>&lt;P&gt;Hi!&lt;/P&gt;

&lt;P&gt;I would like to get some help with search commands.&lt;BR /&gt;
I have a result like,&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;string                     dT  count
1412175602_AAA_T1_32       4   1
1412125204_AAA_T1_34       2   3
1380813000_AAA_T2_50       16  2
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;In this situation I want to expand the rows of number of counts&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;string                     dT
1412175602_AAA_T1_32       4
1412125204_AAA_T1_34       2
1412125204_AAA_T1_34       2
1412125204_AAA_T1_34       2
1380813000_AAA_T2_50       16
1380813000_AAA_T2_50       16
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Would there any way to do this?&lt;/P&gt;

&lt;P&gt;Any help is appreciated!&lt;/P&gt;

&lt;P&gt;Thanks,&lt;BR /&gt;
Yu&lt;/P&gt;</description>
      <pubDate>Thu, 31 Oct 2013 01:35:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Expanding-rows-to-certain-number-of-rows/m-p/123613#M33383</guid>
      <dc:creator>yuwtennis</dc:creator>
      <dc:date>2013-10-31T01:35:15Z</dc:date>
    </item>
    <item>
      <title>Re: Expanding rows to certain number of rows</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Expanding-rows-to-certain-number-of-rows/m-p/123614#M33384</link>
      <description>&lt;P&gt;Append this to your search:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;... | eval temp = replace(tostring(pow(10, count-1)), "(\d)", "\1,") | makemv temp delim="," | mvexpand temp | fields - temp
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Thu, 31 Oct 2013 13:26:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Expanding-rows-to-certain-number-of-rows/m-p/123614#M33384</guid>
      <dc:creator>martin_mueller</dc:creator>
      <dc:date>2013-10-31T13:26:53Z</dc:date>
    </item>
  </channel>
</rss>

