Hi, all!
I have a table
I want to be like this
How can I do this?
Can help me?
| makeresults
| eval _raw="A,1,2,3,4,HI,HELLO,OK
B,5,6,7,8,HI,HELLO,OK"
| multikv noheader=t
| rename Column_1 as name
| rename Column_2 as in
| rename Column_3 as out
| rename Column_4 as in1
| rename Column_5 as out1
| rename Column_6 as data1
| rename Column_7 as data2
| rename Column_8 as data3
| fields name in out in1 out1 data1 data2 data3
| fields - _raw _time
| transpose 0 header_field=name column_name=name
| eval C=if(isnum(A),(A*2)+B,A)
| eval D=if(isnum(A),(A*2)+(B*2),A)
| transpose 0 header_field=name column_name=name
| transpose 0 header_field=name column_name=name
| eval C=(A*2)+B
| eval D=(A*2)+(B*2)
| transpose 0 header_field=name column_name=name
Where name is the name of the first column
@ITWhisperer Thank you so much
But the columns that is not a number is null, is it can to join at the same time?
Do you mean you don't have the first column of your table in splunk?
If so, you can add a field (column) to each row before the transpose
| streamstats count as row
| eval row="row".row
| transpose 0 header_field=row column_name=row
| eval row3=(row1*2)+row2
| eval row4=(row1*2)+(row2*2)
| transpose 0 header_field=row column_name=row
| makeresults
| eval _raw="A,1,2,3,4,HI,HELLO,OK
B,5,6,7,8,HI,HELLO,OK"
| multikv noheader=t
| rename Column_1 as name
| rename Column_2 as in
| rename Column_3 as out
| rename Column_4 as in1
| rename Column_5 as out1
| rename Column_6 as data1
| rename Column_7 as data2
| rename Column_8 as data3
| fields name in out in1 out1 data1 data2 data3
| fields - _raw _time
| transpose 0 header_field=name column_name=name
| eval C=if(isnum(A),(A*2)+B,A)
| eval D=if(isnum(A),(A*2)+(B*2),A)
| transpose 0 header_field=name column_name=name
Thank you
Thank you so much
but I still have a lot of questions
Can you give me your contact information?