Getting Data In

How to merge and unmerge only specific cells, so that I can export results easily to Excel?

harish1992
New Member

alt text

Can someone please help me in getting the search results query in above format which is needed? I had used stats command to group the fields in the search results.

Thanks!

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

The way I do this, solely for presentation to humans, is to use mvjoin...

   | eval fieldE = mvjoin(fieldE,"!!!!")
   | eval fieldF = mvjoin(fieldF,"!!!!")

...and then export to csv and go into the Excel spreadsheet and do a mass replace of "!!!!" with a carriage return (insert one into the box using ctrl-j).

This gives you carriage returns inside the cell to make the single cell in Column E have your desired four rows of height. It does NOT create four cells.


It would be possible to build a macro that would detect single subsequent values in each column and merge the cells, but the amount of work involved in doing that merely for visual presentation is out of scale with the value created.

0 Karma

harish1992
New Member

I understand, macro would work. But I expect to show results in the specific format in Splunk itself. Possible?

0 Karma

harish1992
New Member

I tried doing this, carriage return makes the values split into four in the same cell. My requirement is "I want to merge first four column values into one single cell and the remaining columns with individual rows". I have mentioned it by highlighting in yellow colour and borders.

0 Karma

harish1992
New Member

I understand, macro would work. But I expect to show results in the specific format in Splunk itself. Possible?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Can you share your splunk search?

You could either tweek your search so it gives the desired result or use mvexpand

0 Karma

harish1992
New Member

Yes I tried using mvexpand, it is not working properly. mvexpand splits the values but not in the same row. 😞

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...