https://community.splunk.com/t5/Splunk-Search/How-to-make-headers-as-field-values/m-p/333327#M99117 <P>I have a table that looks like this<BR /> Site 1 2 3 4 5 6<BR /><BR /> In Scope Onsite 3.5 2.44 2.4809851 1.164 2.3125 Local<BR /> In Scope Offshore 2 3 0.505 1.136 International</P> <P>and I want to transform it to like this, </P> <P>Site Phase effort month<BR /> In Scope Onsite Local 2.3125 6<BR /> In Scope Onsite Local 3.5 1<BR /> In Scope Onsite Local 2.44 2<BR /> In Scope Onsite Local 2.4809851 3<BR /> In Scope Onsite Local 1.164 4<BR /> In Scope Offshore International 2 1<BR /> In Scope Offshore International 3 2<BR /> In Scope Offshore International 0.505 3<BR /> In Scope Offshore International 1.136 4</P> <P>Please advise. Thanks!</P> Wed, 13 Sep 2017 03:46:06 GMT teddyidc1101 2017-09-13T03:46:06Z https://community.splunk.com/t5/Splunk-Search/How-to-make-headers-as-field-values/m-p/333327#M99117 <P>I have a table that looks like this<BR /> Site 1 2 3 4 5 6<BR /><BR /> In Scope Onsite 3.5 2.44 2.4809851 1.164 2.3125 Local<BR /> In Scope Offshore 2 3 0.505 1.136 International</P> <P>and I want to transform it to like this, </P> <P>Site Phase effort month<BR /> In Scope Onsite Local 2.3125 6<BR /> In Scope Onsite Local 3.5 1<BR /> In Scope Onsite Local 2.44 2<BR /> In Scope Onsite Local 2.4809851 3<BR /> In Scope Onsite Local 1.164 4<BR /> In Scope Offshore International 2 1<BR /> In Scope Offshore International 3 2<BR /> In Scope Offshore International 0.505 3<BR /> In Scope Offshore International 1.136 4</P> <P>Please advise. Thanks!</P> Wed, 13 Sep 2017 03:46:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-headers-as-field-values/m-p/333327#M99117 teddyidc1101 2017-09-13T03:46:06Z https://community.splunk.com/t5/Splunk-Search/How-to-make-headers-as-field-values/m-p/333328#M99118 <P>Is uptake going well?<BR /> I think that it will work with the following.</P> <P>your search | rename 1 as test1 ,2 as test2,3 as test3 , 4 as test4 , 5 as test5 ,6 as test6 | eval Result=mvappend(test1,test2,test3,test4,test5,test6) | eval effort=mvfilter(match(Result,"\d+")) | mvexpand effort | streamstats count by Site | eval Phase=case(Site=="In Scope Offshore","International",Site=="In Scope Onsite","local") | rename count as month | table Site Phase effort month</P> Wed, 13 Sep 2017 06:06:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-headers-as-field-values/m-p/333328#M99118 oda 2017-09-13T06:06:11Z https://community.splunk.com/t5/Splunk-Search/How-to-make-headers-as-field-values/m-p/333329#M99119 <P>works as expected!</P> Wed, 13 Sep 2017 09:25:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-headers-as-field-values/m-p/333329#M99119 teddyidc1101 2017-09-13T09:25:28Z https://community.splunk.com/t5/Splunk-Search/How-to-make-headers-as-field-values/m-p/333330#M99120 <P>thank you!</P> Wed, 13 Sep 2017 09:25:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-headers-as-field-values/m-p/333330#M99120 teddyidc1101 2017-09-13T09:25:41Z https://community.splunk.com/t5/Splunk-Search/How-to-make-headers-as-field-values/m-p/333331#M99121 <P>thank you for your reply<BR /> it is nice!</P> Wed, 13 Sep 2017 09:27:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-headers-as-field-values/m-p/333331#M99121 oda 2017-09-13T09:27:55Z https://community.splunk.com/t5/Splunk-Search/How-to-make-headers-as-field-values/m-p/333332#M99122 <P>hello! i encountered an issue on some of the occurrences while checking the results. the count should corresponds to a month,right? I extended the months to 12, some of them worked but some continued to 13 onwards moving to 60+. is there a way to limit the count per mv field? </P> Thu, 14 Sep 2017 00:12:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-headers-as-field-values/m-p/333332#M99122 teddyidc1101 2017-09-14T00:12:35Z https://community.splunk.com/t5/Splunk-Search/How-to-make-headers-as-field-values/m-p/333333#M99123 <P>Can you define the field well?<BR /> Sample log and sample fields and<BR /> please tell me the expected behavior.</P> Thu, 14 Sep 2017 00:36:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-headers-as-field-values/m-p/333333#M99123 oda 2017-09-14T00:36:21Z https://community.splunk.com/t5/Splunk-Search/How-to-make-headers-as-field-values/m-p/333334#M99124 <P>Sorry for the delayed response but this is working as expected...thanks so much for the help!</P> Tue, 06 Feb 2018 00:04:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-headers-as-field-values/m-p/333334#M99124 teddyidc1101 2018-02-06T00:04:27Z https://community.splunk.com/t5/Splunk-Search/How-to-make-headers-as-field-values/m-p/333335#M99125 <P>That's good!<BR /> Thank you!</P> Tue, 06 Feb 2018 00:46:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-headers-as-field-values/m-p/333335#M99125 oda 2018-02-06T00:46:36Z