How to merge and unmerge only specific cells, so that I can export results easily to Excel?

[harish1992]

Can someone please help me in getting the search results query in above format which is needed? I had used stats command to group the fields in the search results.

Thanks!

[DalJeanis]

The way I do this, solely for presentation to humans, is to use mvjoin...

   | eval fieldE = mvjoin(fieldE,"!!!!")
   | eval fieldF = mvjoin(fieldF,"!!!!")

...and then export to csv and go into the Excel spreadsheet and do a mass replace of "!!!!" with a carriage return (insert one into the box using ctrl-j).

This gives you carriage returns inside the cell to make the single cell in Column E have your desired four rows of height. It does NOT create four cells.

---

It would be possible to build a macro that would detect single subsequent values in each column and merge the cells, but the amount of work involved in doing that merely for visual presentation is out of scale with the value created.

[harish1992]

I understand, macro would work. But I expect to show results in the specific format in Splunk itself. Possible?

[harish1992]

I tried doing this, carriage return makes the values split into four in the same cell. My requirement is "I want to merge first four column values into one single cell and the remaining columns with individual rows". I have mentioned it by highlighting in yellow colour and borders.

[harish1992]

I understand, macro would work. But I expect to show results in the specific format in Splunk itself. Possible?

[skoelpin]

Can you share your splunk search?

You could either tweek your search so it gives the desired result or use mvexpand

[harish1992]

Yes I tried using mvexpand, it is not working properly. mvexpand splits the values but not in the same row. 😞