Getting Data In

How to split a column of results into two?

masonwhite
Explorer

I have the following table and i wish to split the data to two columns one weighted one not:
all of these fields are generated through eval commands the only actual field is the "headcountestimate" therefore a simple lookup or appedcols wouldn't do. Any commands come to mind?
current table:

column  -------------------------------------------------------row 1
Total Estimated Headcount   ---------------------------###
Total Actual Headcount Needed   --------------------####
Total Overestimated Headcount   --------------------###
% Overestimated Headcount   ------------------------%%%
Weighted Total Estimated Headcount  -------------###
Weighted Total Actual Headcount Needed-------###
Weighted Total Overestimated Headcount-------####
Weighted % Overestimated Headcount  ----------%%%

Would like :

Column1----------------------------------------------------Weighted -------------------------------------------------------Unweighted
Estimated Headcount ----------------------------------------###-------------------------------------------------------------###
Actual Headcount Needed ----------------------------------####-----------------------------------------------------------###
Overestimated Headcount ----------------------------------###------------------------------------------------------------###
%Overestimated Headcount    -------------------------------%%%-------------------------------------------------------%%%
0 Karma
1 Solution

somesoni2
Revered Legend

Your current table looks like output of transpose command. There may be a better answer if you could share you full search.

With that not available, try something like this

your current search giving fields 'column' 'row 1'
| eval type=if(like(column,"Weighted%"),"Weighted","Unweighted")
| eval column=replace(column,"^.*Total (.+)","\1")
| chart values("row 1") over column by type

View solution in original post

somesoni2
Revered Legend

Your current table looks like output of transpose command. There may be a better answer if you could share you full search.

With that not available, try something like this

your current search giving fields 'column' 'row 1'
| eval type=if(like(column,"Weighted%"),"Weighted","Unweighted")
| eval column=replace(column,"^.*Total (.+)","\1")
| chart values("row 1") over column by type

masonwhite
Explorer

SPOT ON! I understand that including the search would be more helpful but unfortunately every field is a proprietary field and would take way to long to mask. But even without the search added your syntax in the proper placement and it was like magic! thank you ...

the only issue now is that the two percentage rows are showing up separate ( still a row for weighted % and one for unweighted) but i can deal with that it seems as that is due to my search and eval commands building those two fields separately.

0 Karma

somesoni2
Revered Legend

Replace eval column... in above query with this

 | eval column=replace(column,"^(Total |Weighted Total |Weighted )*(.+)","\2")
0 Karma

masonwhite
Explorer

Nice! This fixed it. you are awesome !

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Introducing ITSI 5.0: Unified Visibility and Actionable Insights Tuesday, July 21, 2026  |  10:00AM PT / ...

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

Inside Splunk Agent Observability:Understanding Agent Behavior, Tokens & Costs Thursday, August 06, ...

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...