Getting Data In

How to split a column of results into two?

masonwhite
Explorer

I have the following table and i wish to split the data to two columns one weighted one not:
all of these fields are generated through eval commands the only actual field is the "headcountestimate" therefore a simple lookup or appedcols wouldn't do. Any commands come to mind?
current table:

column  -------------------------------------------------------row 1
Total Estimated Headcount   ---------------------------###
Total Actual Headcount Needed   --------------------####
Total Overestimated Headcount   --------------------###
% Overestimated Headcount   ------------------------%%%
Weighted Total Estimated Headcount  -------------###
Weighted Total Actual Headcount Needed-------###
Weighted Total Overestimated Headcount-------####
Weighted % Overestimated Headcount  ----------%%%

Would like :

Column1----------------------------------------------------Weighted -------------------------------------------------------Unweighted
Estimated Headcount ----------------------------------------###-------------------------------------------------------------###
Actual Headcount Needed ----------------------------------####-----------------------------------------------------------###
Overestimated Headcount ----------------------------------###------------------------------------------------------------###
%Overestimated Headcount    -------------------------------%%%-------------------------------------------------------%%%
0 Karma
1 Solution

somesoni2
Revered Legend

Your current table looks like output of transpose command. There may be a better answer if you could share you full search.

With that not available, try something like this

your current search giving fields 'column' 'row 1'
| eval type=if(like(column,"Weighted%"),"Weighted","Unweighted")
| eval column=replace(column,"^.*Total (.+)","\1")
| chart values("row 1") over column by type

View solution in original post

somesoni2
Revered Legend

Your current table looks like output of transpose command. There may be a better answer if you could share you full search.

With that not available, try something like this

your current search giving fields 'column' 'row 1'
| eval type=if(like(column,"Weighted%"),"Weighted","Unweighted")
| eval column=replace(column,"^.*Total (.+)","\1")
| chart values("row 1") over column by type

masonwhite
Explorer

SPOT ON! I understand that including the search would be more helpful but unfortunately every field is a proprietary field and would take way to long to mask. But even without the search added your syntax in the proper placement and it was like magic! thank you ...

the only issue now is that the two percentage rows are showing up separate ( still a row for weighted % and one for unweighted) but i can deal with that it seems as that is due to my search and eval commands building those two fields separately.

0 Karma

somesoni2
Revered Legend

Replace eval column... in above query with this

 | eval column=replace(column,"^(Total |Weighted Total |Weighted )*(.+)","\2")
0 Karma

masonwhite
Explorer

Nice! This fixed it. you are awesome !

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...