All Apps and Add-ons

search for converting the column to rows :

vikasreddy
Explorer

Need Help in converting the Columns to  single rows depending on the primary key column values .

 I have a  data show in below  with 3 columns 

DocID  | DocType        |  DocProperty

123       | soft Copy       |   xy

123       | Hard Copy     | zx

124       |   Softcopy      |xy

 I need result as shown below 

DocID  | DocType 1   | DocType 2  |  DocProperty1  | DocProperty1

123       | soft Copy     | Hard Copy   | xy                            | zx

124       |   Softcopy    |xy


 Note :I have tried  different ways but no luck all i am getting is 

DocID  | DocType 1   | DocType 2  |  DocProperty1  | DocProperty1

123       | soft Copy       | Empty cell  | xy                          | Emptycell

123       | Empty cell     | Hard Copy   | Emptycell           | zx

124       |   Softcopy    |xy

related records should be In one line without empty cell .


Thanks !

Labels (1)
0 Karma

to4kawa
Ultra Champion

sample:

| makeresults
| eval _raw="DocID,DocType,DocProperty
123,soft Copy,xy
123,Hard Copy,zx
124,Softcopy,xy"
| multikv forceheader=1
| table DocID,DocType,DocProperty
| rename COMMENT as "this is logic"
| untable DocID types values
| streamstats global=f count by DocID types
| eval types=types.count
| xyseries DocID types values
| table DocID DocType* DocProperty*

untable and xyseries are useful.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you're getting that far, then adding a stats command should get you the rest of the way.

... | stats values(*) as * by DocID
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...