All Apps and Add-ons

search for converting the column to rows :


Need Help in converting the Columns to  single rows depending on the primary key column values .

 I have a  data show in below  with 3 columns 

DocID  | DocType        |  DocProperty

123       | soft Copy       |   xy

123       | Hard Copy     | zx

124       |   Softcopy      |xy

 I need result as shown below 

DocID  | DocType 1   | DocType 2  |  DocProperty1  | DocProperty1

123       | soft Copy     | Hard Copy   | xy                            | zx

124       |   Softcopy    |xy

 Note :I have tried  different ways but no luck all i am getting is 

DocID  | DocType 1   | DocType 2  |  DocProperty1  | DocProperty1

123       | soft Copy       | Empty cell  | xy                          | Emptycell

123       | Empty cell     | Hard Copy   | Emptycell           | zx

124       |   Softcopy    |xy

related records should be In one line without empty cell .

Thanks !

Labels (1)
0 Karma

Ultra Champion


| makeresults
| eval _raw="DocID,DocType,DocProperty
123,soft Copy,xy
123,Hard Copy,zx
| multikv forceheader=1
| table DocID,DocType,DocProperty
| rename COMMENT as "this is logic"
| untable DocID types values
| streamstats global=f count by DocID types
| eval types=types.count
| xyseries DocID types values
| table DocID DocType* DocProperty*

untable and xyseries are useful.

0 Karma


If you're getting that far, then adding a stats command should get you the rest of the way.

... | stats values(*) as * by DocID
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...