Getting Data In

How to split a column of results into two?

masonwhite
Explorer

I have the following table and i wish to split the data to two columns one weighted one not:
all of these fields are generated through eval commands the only actual field is the "headcountestimate" therefore a simple lookup or appedcols wouldn't do. Any commands come to mind?
current table:

column  -------------------------------------------------------row 1
Total Estimated Headcount   ---------------------------###
Total Actual Headcount Needed   --------------------####
Total Overestimated Headcount   --------------------###
% Overestimated Headcount   ------------------------%%%
Weighted Total Estimated Headcount  -------------###
Weighted Total Actual Headcount Needed-------###
Weighted Total Overestimated Headcount-------####
Weighted % Overestimated Headcount  ----------%%%

Would like :

Column1----------------------------------------------------Weighted -------------------------------------------------------Unweighted
Estimated Headcount ----------------------------------------###-------------------------------------------------------------###
Actual Headcount Needed ----------------------------------####-----------------------------------------------------------###
Overestimated Headcount ----------------------------------###------------------------------------------------------------###
%Overestimated Headcount    -------------------------------%%%-------------------------------------------------------%%%
0 Karma
1 Solution

somesoni2
Revered Legend

Your current table looks like output of transpose command. There may be a better answer if you could share you full search.

With that not available, try something like this

your current search giving fields 'column' 'row 1'
| eval type=if(like(column,"Weighted%"),"Weighted","Unweighted")
| eval column=replace(column,"^.*Total (.+)","\1")
| chart values("row 1") over column by type

View solution in original post

somesoni2
Revered Legend

Your current table looks like output of transpose command. There may be a better answer if you could share you full search.

With that not available, try something like this

your current search giving fields 'column' 'row 1'
| eval type=if(like(column,"Weighted%"),"Weighted","Unweighted")
| eval column=replace(column,"^.*Total (.+)","\1")
| chart values("row 1") over column by type

masonwhite
Explorer

SPOT ON! I understand that including the search would be more helpful but unfortunately every field is a proprietary field and would take way to long to mask. But even without the search added your syntax in the proper placement and it was like magic! thank you ...

the only issue now is that the two percentage rows are showing up separate ( still a row for weighted % and one for unweighted) but i can deal with that it seems as that is due to my search and eval commands building those two fields separately.

0 Karma

somesoni2
Revered Legend

Replace eval column... in above query with this

 | eval column=replace(column,"^(Total |Weighted Total |Weighted )*(.+)","\2")
0 Karma

masonwhite
Explorer

Nice! This fixed it. you are awesome !

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...