<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to change the output format of search results? in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-to-change-the-output-format-of-search-results/m-p/224560#M66172</link>
    <description>&lt;P&gt;I assume your query looks like this (you may have list, instead of values)&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;base search | stats values(y) as y by x
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;change this to...&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;base search | stats values(y) as y by x | mvexpand y
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Mon, 15 Aug 2016 02:07:12 GMT</pubDate>
    <dc:creator>sundareshr</dc:creator>
    <dc:date>2016-08-15T02:07:12Z</dc:date>
    <item>
      <title>How to change the output format of search results?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-change-the-output-format-of-search-results/m-p/224559#M66171</link>
      <description>&lt;P&gt;Using my splunk query, I am getting the output as follows (X and Y are headers)- &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;X         Y
-----------
1        A
         B
         C
2        A
         B
         C
3        A
         B
         C
4        A
         B
         C
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;But I need the output in the below format - &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;X         Y
-----------
1         A
1         B
1         C
2         A
2         B
2         C
3         A
3         B
3         C
4         A
4         B
4         C
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I tried using stats, list, and other formatting commands but it didn't work for me.&lt;BR /&gt;
Can I get any help? Thanks in advance....&lt;/P&gt;</description>
      <pubDate>Mon, 15 Aug 2016 01:28:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-change-the-output-format-of-search-results/m-p/224559#M66171</guid>
      <dc:creator>gadeanup1</dc:creator>
      <dc:date>2016-08-15T01:28:53Z</dc:date>
    </item>
    <item>
      <title>Re: How to change the output format of search results?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-change-the-output-format-of-search-results/m-p/224560#M66172</link>
      <description>&lt;P&gt;I assume your query looks like this (you may have list, instead of values)&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;base search | stats values(y) as y by x
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;change this to...&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;base search | stats values(y) as y by x | mvexpand y
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Mon, 15 Aug 2016 02:07:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-change-the-output-format-of-search-results/m-p/224560#M66172</guid>
      <dc:creator>sundareshr</dc:creator>
      <dc:date>2016-08-15T02:07:12Z</dc:date>
    </item>
    <item>
      <title>Re: How to change the output format of search results?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-change-the-output-format-of-search-results/m-p/224561#M66173</link>
      <description>&lt;P&gt;Good learnings, Sundaresh Sir.&lt;/P&gt;</description>
      <pubDate>Mon, 15 Aug 2016 05:41:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-change-the-output-format-of-search-results/m-p/224561#M66173</guid>
      <dc:creator>inventsekar</dc:creator>
      <dc:date>2016-08-15T05:41:45Z</dc:date>
    </item>
  </channel>
</rss>

