Getting Data In

How to split a column of results into two?

masonwhite
Explorer

I have the following table and i wish to split the data to two columns one weighted one not:
all of these fields are generated through eval commands the only actual field is the "headcountestimate" therefore a simple lookup or appedcols wouldn't do. Any commands come to mind?
current table:

column  -------------------------------------------------------row 1
Total Estimated Headcount   ---------------------------###
Total Actual Headcount Needed   --------------------####
Total Overestimated Headcount   --------------------###
% Overestimated Headcount   ------------------------%%%
Weighted Total Estimated Headcount  -------------###
Weighted Total Actual Headcount Needed-------###
Weighted Total Overestimated Headcount-------####
Weighted % Overestimated Headcount  ----------%%%

Would like :

Column1----------------------------------------------------Weighted -------------------------------------------------------Unweighted
Estimated Headcount ----------------------------------------###-------------------------------------------------------------###
Actual Headcount Needed ----------------------------------####-----------------------------------------------------------###
Overestimated Headcount ----------------------------------###------------------------------------------------------------###
%Overestimated Headcount    -------------------------------%%%-------------------------------------------------------%%%
0 Karma
1 Solution

somesoni2
Revered Legend

Your current table looks like output of transpose command. There may be a better answer if you could share you full search.

With that not available, try something like this

your current search giving fields 'column' 'row 1'
| eval type=if(like(column,"Weighted%"),"Weighted","Unweighted")
| eval column=replace(column,"^.*Total (.+)","\1")
| chart values("row 1") over column by type

View solution in original post

somesoni2
Revered Legend

Your current table looks like output of transpose command. There may be a better answer if you could share you full search.

With that not available, try something like this

your current search giving fields 'column' 'row 1'
| eval type=if(like(column,"Weighted%"),"Weighted","Unweighted")
| eval column=replace(column,"^.*Total (.+)","\1")
| chart values("row 1") over column by type

masonwhite
Explorer

SPOT ON! I understand that including the search would be more helpful but unfortunately every field is a proprietary field and would take way to long to mask. But even without the search added your syntax in the proper placement and it was like magic! thank you ...

the only issue now is that the two percentage rows are showing up separate ( still a row for weighted % and one for unweighted) but i can deal with that it seems as that is due to my search and eval commands building those two fields separately.

0 Karma

somesoni2
Revered Legend

Replace eval column... in above query with this

 | eval column=replace(column,"^(Total |Weighted Total |Weighted )*(.+)","\2")
0 Karma

masonwhite
Explorer

Nice! This fixed it. you are awesome !

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...