Getting Data In

How to merge and unmerge only specific cells, so that I can export results easily to Excel?

harish1992
New Member

alt text

Can someone please help me in getting the search results query in above format which is needed? I had used stats command to group the fields in the search results.

Thanks!

0 Karma

DalJeanis
Legend

The way I do this, solely for presentation to humans, is to use mvjoin...

   | eval fieldE = mvjoin(fieldE,"!!!!")
   | eval fieldF = mvjoin(fieldF,"!!!!")

...and then export to csv and go into the Excel spreadsheet and do a mass replace of "!!!!" with a carriage return (insert one into the box using ctrl-j).

This gives you carriage returns inside the cell to make the single cell in Column E have your desired four rows of height. It does NOT create four cells.


It would be possible to build a macro that would detect single subsequent values in each column and merge the cells, but the amount of work involved in doing that merely for visual presentation is out of scale with the value created.

0 Karma

harish1992
New Member

I understand, macro would work. But I expect to show results in the specific format in Splunk itself. Possible?

0 Karma

harish1992
New Member

I tried doing this, carriage return makes the values split into four in the same cell. My requirement is "I want to merge first four column values into one single cell and the remaining columns with individual rows". I have mentioned it by highlighting in yellow colour and borders.

0 Karma

harish1992
New Member

I understand, macro would work. But I expect to show results in the specific format in Splunk itself. Possible?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Can you share your splunk search?

You could either tweek your search so it gives the desired result or use mvexpand

0 Karma

harish1992
New Member

Yes I tried using mvexpand, it is not working properly. mvexpand splits the values but not in the same row. 😞

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...