Splunk Search

How do I normalize, flatten, or unpivot table data?

lamchr
Engager

I am trying to take the results of a timechart table and normalize/flatten/un-pivot the data. For example, I have the following results table:

_time A B C
1-2015 1 4 7
2-2015 2 5 8
3-2015 3 6 9

And I want to convert this into:

_name _time value
A 1-2015 1
A 2-2015 2
A 3-2015 3
B 1-2015 4
B 2-2015 5
B 3-2015 6
C 1-2015 7
C 2-2015 8
C 3-2015 9

How do I do this? Thanks!

1 Solution

lamchr
Engager

Nevermind. I figured it out: I need to use the untable command.

View solution in original post

0 Karma

lamchr
Engager

Nevermind. I figured it out: I need to use the untable command.

View solution in original post

0 Karma

3rdEchelon
Engager

For others who have this same issue, here is another post on Splunk Answers which has more helpful information: https://answers.splunk.com/answers/136599/how-to-convert-multiple-fieldname-fieldvalue-entries-into-...

0 Karma

3rdEchelon
Engager

Do you mind posting the untable command you used for this? Just would be helpful to have it posted for others trying to do the same thing, because the untable documentation is not very descriptive. Thanks!

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.