Splunk Search

How can I transpose/transform data in multiple rows?

quahfamili
Path Finder

Hi all,

I was preparing my data to be visualised. However, I met with a challenge. The below is an extract of my data:

alt text

My desire output would be:

alt text

Note that the key value is dynamic, there could be 10 to 20 numbers of keys.
Anyone has any idea to achieve this?

Thanks in advance!

0 Karma
1 Solution

vnravikumar
Champion

Hi

Try this

your query... 
| table key,value,field1,field2 
| eval {key}=value 
| fields - key, value 
| table *

View solution in original post

vnravikumar
Champion

Hi

Try this

your query... 
| table key,value,field1,field2 
| eval {key}=value 
| fields - key, value 
| table *

quahfamili
Path Finder

Hi it works, 1 more question for {} how do i control the numbers of keys? it seems like defaulted at 24 columns.

0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...