topic How do you swap key/value pairs for two-column data? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-you-swap-key-value-pairs-for-two-column-data/m-p/218298#M64155 <P>I'm trying to swap the roles of two columns. Normally, there is one "key" in the first column for every group of "values" in the second column. What if I want the values to become the keys? For instance, let's say the search "|index = dataname| table ColA, ColB" returns the following: </P> <P>Col A Col B<BR /> John Seahawks, Lions, 49ers<BR /> Jason Titans, Seahawks, Dolphins<BR /> Rick Texans, Dolphins</P> <P>I'd like the search redone. Should become</P> <P>Col B Col A<BR /> Seahawks John, Jason<BR /> Lions John<BR /> 49ers John<BR /> Titans Jason<BR /> Dolphins Jason, Rick<BR /> Texans Rick</P> Wed, 04 Jan 2017 06:23:37 GMT jturner900 2017-01-04T06:23:37Z How do you swap key/value pairs for two-column data? https://community.splunk.com/t5/Splunk-Search/How-do-you-swap-key-value-pairs-for-two-column-data/m-p/218298#M64155 <P>I'm trying to swap the roles of two columns. Normally, there is one "key" in the first column for every group of "values" in the second column. What if I want the values to become the keys? For instance, let's say the search "|index = dataname| table ColA, ColB" returns the following: </P> <P>Col A Col B<BR /> John Seahawks, Lions, 49ers<BR /> Jason Titans, Seahawks, Dolphins<BR /> Rick Texans, Dolphins</P> <P>I'd like the search redone. Should become</P> <P>Col B Col A<BR /> Seahawks John, Jason<BR /> Lions John<BR /> 49ers John<BR /> Titans Jason<BR /> Dolphins Jason, Rick<BR /> Texans Rick</P> Wed, 04 Jan 2017 06:23:37 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-swap-key-value-pairs-for-two-column-data/m-p/218298#M64155 jturner900 2017-01-04T06:23:37Z Re: How do you swap key/value pairs for two-column data? https://community.splunk.com/t5/Splunk-Search/How-do-you-swap-key-value-pairs-for-two-column-data/m-p/218299#M64156 <P>Splunk statistics commands like stats timechart can split data by the sequence of the field names. So in order to reverse the columns you can try the following two commands</P> <PRE><CODE>index = dataname | stats count by ColA ColB index = dataname | stats count by ColB ColA </CODE></PRE> Wed, 04 Jan 2017 07:08:58 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-swap-key-value-pairs-for-two-column-data/m-p/218299#M64156 niketn 2017-01-04T07:08:58Z