Archive
Highlighted

TRANSFORMING TABLE

Path Finder

I have data as given below in table format
A B C D E F
517 2498 186 1000 250 100
399 314 1559 100 100 1000

I want each row of D E and F against each row of A B and C kind of cross transformation
output should look like this:
A B C D E F
517 2498 186 1000 250 100
517 2498 186 100 100 1000
399 314 1559 1000 250 100
399 314 1559 100 100 1000

Thanks in advance!

0 Karma
Highlighted

Re: TRANSFORMING TABLE

SplunkTrust
SplunkTrust

If I'm reading that correctly, any answer you get here has the distinct possibility that it will make your Splunk servers start sobbing uncontrollably.

In your two original events, you see you end up with four results.
If you repeated with three original events, you would end up with nine.
Four would end up sixteen...

By the time you a few hundred events, you might start having problems.

BUT this is OK, I just wanted to be clear about possible side effects and be sure that you know what you are asking?

0 Karma
Highlighted

Re: TRANSFORMING TABLE

Path Finder

Hi,

I understood your point. But actually, my original data has fixed and fewer events hence this kind of issue is not going to affect my splunk servers. 🙂

0 Karma
Highlighted

Re: TRANSFORMING TABLE

SplunkTrust
SplunkTrust

Great! Some folks don't always think everything through to the end, so I'm glad you have already done so!

(And sometimes it's worth noting specifically so someone else with unbounded results might be forewarned just a bit that they'll have to use care with this solution... 🙂 )

Happy Splunking!

0 Karma
Highlighted

Re: TRANSFORMING TABLE

Contributor

| eval row=A.B.C.D.F.",".A.B.C.D.F
| makemv delim="," row
| mvexpand row

0 Karma
Highlighted

Re: TRANSFORMING TABLE

Path Finder

Thanks for your response, but this is not giving me required results.

0 Karma