Splunk Search

Expanding rows to certain number of rows

yuwtennis
Communicator

Hi!

I would like to get some help with search commands.
I have a result like,

string                     dT  count
1412175602_AAA_T1_32       4   1
1412125204_AAA_T1_34       2   3
1380813000_AAA_T2_50       16  2

In this situation I want to expand the rows of number of counts

string                     dT
1412175602_AAA_T1_32       4
1412125204_AAA_T1_34       2
1412125204_AAA_T1_34       2
1412125204_AAA_T1_34       2
1380813000_AAA_T2_50       16
1380813000_AAA_T2_50       16

Would there any way to do this?

Any help is appreciated!

Thanks,
Yu

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Append this to your search:

... | eval temp = replace(tostring(pow(10, count-1)), "(\d)", "\1,") | makemv temp delim="," | mvexpand temp | fields - temp
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...