https://community.splunk.com/t5/Splunk-Search/How-to-make-from-one-row-two/m-p/137150#M37567 <P>You could insert this:</P> <PRE><CODE>... | fillnull value="n/a" Login1 Login2 | ... </CODE></PRE> Tue, 29 Apr 2014 13:47:18 GMT martin_mueller 2014-04-29T13:47:18Z https://community.splunk.com/t5/Splunk-Search/How-to-make-from-one-row-two/m-p/137142#M37559 <P>Hello All<BR /> My table looks like these</P> <P>Number Name Position Login1 Login2</P> <P>1 John expert johns1 johns2</P> <P>is it possible to make another table which looks like<BR /> Number Name Position Login<BR /> 1 John expert johns1<BR /> 2 John expert johns2</P> <P>Thanks for all answers!</P> Mon, 21 Apr 2014 13:08:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-from-one-row-two/m-p/137142#M37559 andrey2007 2014-04-21T13:08:16Z https://community.splunk.com/t5/Splunk-Search/How-to-make-from-one-row-two/m-p/137143#M37560 <P>Maybe something like this?</P> <PRE><CODE>&lt;your search&gt; | rename Login1 as Login | rename Login2 as Login | sort by Login | table Number,Name,Position,Login </CODE></PRE> Mon, 21 Apr 2014 13:17:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-from-one-row-two/m-p/137143#M37560 treinke 2014-04-21T13:17:24Z https://community.splunk.com/t5/Splunk-Search/How-to-make-from-one-row-two/m-p/137144#M37561 <P>sorry, but not<BR /> this way table looks like<BR /> Number Name Position Login2</P> Mon, 21 Apr 2014 13:26:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-from-one-row-two/m-p/137144#M37561 andrey2007 2014-04-21T13:26:04Z https://community.splunk.com/t5/Splunk-Search/How-to-make-from-one-row-two/m-p/137145#M37562 <P>If you have just two fields you can do this:</P> <PRE><CODE>base search | eval Login = Login1."###".Login2 | fields - Login1 Login2 | makemv delim="###" Login | mvexpand Login </CODE></PRE> Mon, 21 Apr 2014 14:20:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-from-one-row-two/m-p/137145#M37562 martin_mueller 2014-04-21T14:20:49Z https://community.splunk.com/t5/Splunk-Search/How-to-make-from-one-row-two/m-p/137146#M37563 <P>try using transpose to your result..</P> <PRE><CODE>....your search |table....|transpose </CODE></PRE> Mon, 21 Apr 2014 17:13:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-from-one-row-two/m-p/137146#M37563 krish3 2014-04-21T17:13:42Z https://community.splunk.com/t5/Splunk-Search/How-to-make-from-one-row-two/m-p/137147#M37564 <P>Thanks, it works!<BR /> But with message like this<BR /> Field 'Login' does not exist in the data.</P> Fri, 25 Apr 2014 13:14:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-from-one-row-two/m-p/137147#M37564 andrey2007 2014-04-25T13:14:20Z https://community.splunk.com/t5/Splunk-Search/How-to-make-from-one-row-two/m-p/137148#M37565 <P>Huh? How does it work and throw an error message at the same time?</P> Fri, 25 Apr 2014 14:31:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-from-one-row-two/m-p/137148#M37565 martin_mueller 2014-04-25T14:31:34Z https://community.splunk.com/t5/Splunk-Search/How-to-make-from-one-row-two/m-p/137149#M37566 <P>and it does not work for case like this user has only Login1 OR Login2<BR /> Number Name Position Login1 Login2</P> <P>1 John expert johns2<BR /> 2 Willy expert will1</P> Tue, 29 Apr 2014 13:45:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-from-one-row-two/m-p/137149#M37566 andrey2007 2014-04-29T13:45:54Z https://community.splunk.com/t5/Splunk-Search/How-to-make-from-one-row-two/m-p/137150#M37567 <P>You could insert this:</P> <PRE><CODE>... | fillnull value="n/a" Login1 Login2 | ... </CODE></PRE> Tue, 29 Apr 2014 13:47:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-from-one-row-two/m-p/137150#M37567 martin_mueller 2014-04-29T13:47:18Z