Splunk Search

Expanding rows to certain number of rows

yuwtennis
Communicator

Hi!

I would like to get some help with search commands.
I have a result like,

string                     dT  count
1412175602_AAA_T1_32       4   1
1412125204_AAA_T1_34       2   3
1380813000_AAA_T2_50       16  2

In this situation I want to expand the rows of number of counts

string                     dT
1412175602_AAA_T1_32       4
1412125204_AAA_T1_34       2
1412125204_AAA_T1_34       2
1412125204_AAA_T1_34       2
1380813000_AAA_T2_50       16
1380813000_AAA_T2_50       16

Would there any way to do this?

Any help is appreciated!

Thanks,
Yu

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Append this to your search:

... | eval temp = replace(tostring(pow(10, count-1)), "(\d)", "\1,") | makemv temp delim="," | mvexpand temp | fields - temp
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...