Splunk Search

Change table representation

anisgupt
New Member

I have a table as follows:

CN|Lev|ref1|ref2|ref3|ref4|ref5|ref6
cn1|1|1|2|3|4|||
cn2|2|||||5|6|

The representation required is:

CN|Lev|Ref|Count
cn1|1|ref1|1
cn1|1|ref2|2
cn1|1|ref3|3
cn1|1|ref4|4
cn2|2|ref5|5
cn2|2|ref6|6

Tags (1)
0 Karma

ashajambagi
Communicator

Hi @anisgupt ,

Please try below query and let me know if it helps:

| makeresults 
| eval CN="cn1", Lev="1", ref1="1", ref2="2", ref3="3", ref4="4", ref5="", ref6="" 
| append 
    [| makeresults 
    | eval CN="cn2", Lev="2", ref1="", ref2="", ref3="", ref4="", ref5="5", ref6="6" ] 
| eval cr=mvzip(CN,Lev,"-") 
| fields - _time Lev CN 
| untable cr Ref Count 
| rex field=cr "(?P<CN>[^\,].+)-(?P<Lev>.+)" 
| table CN Lev Ref Count| where Count>0

ashajambagi
Communicator

@anisgupt Can you please accept the answer if it helped with your issue!

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...