All Apps and Add-ons

search for converting the column to rows :

vikasreddy
Explorer

Need Help in converting the Columns to  single rows depending on the primary key column values .

 I have a  data show in below  with 3 columns 

DocID  | DocType        |  DocProperty

123       | soft Copy       |   xy

123       | Hard Copy     | zx

124       |   Softcopy      |xy

 I need result as shown below 

DocID  | DocType 1   | DocType 2  |  DocProperty1  | DocProperty1

123       | soft Copy     | Hard Copy   | xy                            | zx

124       |   Softcopy    |xy


 Note :I have tried  different ways but no luck all i am getting is 

DocID  | DocType 1   | DocType 2  |  DocProperty1  | DocProperty1

123       | soft Copy       | Empty cell  | xy                          | Emptycell

123       | Empty cell     | Hard Copy   | Emptycell           | zx

124       |   Softcopy    |xy

related records should be In one line without empty cell .


Thanks !

Labels (1)
0 Karma

to4kawa
Ultra Champion

sample:

| makeresults
| eval _raw="DocID,DocType,DocProperty
123,soft Copy,xy
123,Hard Copy,zx
124,Softcopy,xy"
| multikv forceheader=1
| table DocID,DocType,DocProperty
| rename COMMENT as "this is logic"
| untable DocID types values
| streamstats global=f count by DocID types
| eval types=types.count
| xyseries DocID types values
| table DocID DocType* DocProperty*

untable and xyseries are useful.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you're getting that far, then adding a stats command should get you the rest of the way.

... | stats values(*) as * by DocID
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...