topic Re: How to transform a table and use column headers as field values? in Splunk Search

How to transform a table and use column headers as field values?

HeinzWaescher — Tue, 12 Jan 2016 15:43:24 GMT

Hi,

I would like to do a transformation like this:

Can you help how to achieve this?

Thanks in advance
Heinz

Re: How to transform a table and use column headers as field values?

sundareshr — Tue, 12 Jan 2016 16:12:10 GMT

Can you share the query for the first table

Re: How to transform a table and use column headers as field values?

HeinzWaescher — Tue, 12 Jan 2016 16:14:33 GMT

Unfortunately the first table would be the result of a csv

Re: How to transform a table and use column headers as field values?

somesoni2 — Tue, 12 Jan 2016 16:47:07 GMT

Try something like this

Your current search giving table 1 | eval temp=name."#".department | fields - name department | untable temp month project | rex field=temp "(?<name>.*)#(?<department>.*)" | table name department month project

Re: How to transform a table and use column headers as field values?

HeinzWaescher — Wed, 13 Jan 2016 13:01:51 GMT

Awesome, thanks a lot!