Splunk Search

Change table representation

anisgupt
New Member

I have a table as follows:

CN|Lev|ref1|ref2|ref3|ref4|ref5|ref6
cn1|1|1|2|3|4|||
cn2|2|||||5|6|

The representation required is:

CN|Lev|Ref|Count
cn1|1|ref1|1
cn1|1|ref2|2
cn1|1|ref3|3
cn1|1|ref4|4
cn2|2|ref5|5
cn2|2|ref6|6

Tags (1)
0 Karma

ashajambagi
Communicator

Hi @anisgupt ,

Please try below query and let me know if it helps:

| makeresults 
| eval CN="cn1", Lev="1", ref1="1", ref2="2", ref3="3", ref4="4", ref5="", ref6="" 
| append 
    [| makeresults 
    | eval CN="cn2", Lev="2", ref1="", ref2="", ref3="", ref4="", ref5="5", ref6="6" ] 
| eval cr=mvzip(CN,Lev,"-") 
| fields - _time Lev CN 
| untable cr Ref Count 
| rex field=cr "(?P<CN>[^\,].+)-(?P<Lev>.+)" 
| table CN Lev Ref Count| where Count>0

ashajambagi
Communicator

@anisgupt Can you please accept the answer if it helped with your issue!

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...