topic Re: How to move values on alternating rows onto the same row in my search results? in Splunk Search

How to move values on alternating rows onto the same row in my search results?

mrfredman — Wed, 08 Apr 2015 17:48:12 GMT

Hi,

I'm using postgres regex to pull two sets of values into my search. I've got all the data I want, but it seems to be on alternating lines.

In rows where column A is populated, column B is blank, and vice versa.

Is there any way to offset or align these values in splunk?

I would love to just move all the values of one column down by a row while leaving the other column as is.

Is this possible?

Re: How to move values on alternating rows onto the same row in my search results?

rsennett_splunk — Wed, 08 Apr 2015 18:18:01 GMT

I presume by "regex to pull two sets of values" you mean a eval foo = if(match(field,regex),thenThis,elseThat))

You need to provide a couple of example events and your search for us to help.

Re: How to move values on alternating rows onto the same row in my search results?

mrfredman — Wed, 08 Apr 2015 18:41:47 GMT

I actually just came across a solution that worked for me. I think it's a bit hacky but it's getting me the results I need.

Solution:
streamstats first(fieldB) window=2

I have to do a bunch of other manipulation now, but that got me to the point where I was able to use more familiar splunk tools to get me what I need.