Splunk Search

How to Split Row value in single column to multiple row value?


I want to split row into multiple row by spliting it under the same column.


col1     col2     col3     col4

A,a        Z,z        B,b        X,x

P,p                       C,c       Y,y


In the above example A,a P,p V,v is in the same row but I want to have it in differet row under column col1.   

Labels (1)
Tags (1)
0 Karma


No I don't get the needed output yet.


0 Karma

Ultra Champion


your search 
| streamstats count as session
| mvexpand col1
| streamstats count as session2 by session
| rename col1 as _col1
| foreach col* [ eval <<FIELD>> = if(session2=1,mvindex(split(<<FIELD>>,","),0),mvindex(split(<<FIELD>>,","),1)) ]
| fields - session*
| rename _col1 as col1


0 Karma


But in my table the value of columns are not like col1,col2 ,etc it is various Name of security attacks.For example:-(TA0003) Persistence

This is one of the name of column.

So can anyone help me with this.......

0 Karma

Ultra Champion

try mvexpand

0 Karma


It wont works because I have varied number of column and I want to split for all the 50 columns that are coming in my output.

So can anyone help me with this...


0 Karma

Ultra Champion
index=_internal | head 1 | fields _raw
| eval _raw="{\"squadName\":\"Super hero squad\",\"homeTown\":\"Metro City\",\"formed\":2016,\"secretBase\":\"Super tower\",\"active\":true,\"members\":[{\"name\":\"Molecule Man\",\"age\":29,\"secretIdentity\":\"Dan Jukes\",\"powers\":[\"Radiation resistance\",\"Turning tiny\",\"Radiation blast\"]},{\"name\":\"Madame Uppercut\",\"age\":39,\"secretIdentity\":\"Jane Wilson\",\"powers\":[\"Million tonne punch\",\"Damage resistance\",\"Superhuman reflexes\"]},{\"name\":\"Eternal Flame\",\"age\":1000000,\"secretIdentity\":\"Unknown\",\"powers\":[\"Immortality\",\"Heat Immunity\",\"Inferno\",\"Teleportation\",\"Interdimensional travel\"]}]}"
| spath 
| fields - _*
| rename *{}.* as *_*
| rename *{} as *
| table *
``` this is sample data```
``` from here, the logic ```
| eval tmp="val"
| transpose 0 header_field=tmp
| streamstats window=1 count(val) as count
| eventstats max(count) as count
| appendpipe [ eval column="count", val=count]
| fields - count
| dedup column
| transpose 0 header_field=column
| fields - column
| eval count=mvrange(0,count)
| mvexpand count
| rename count as _count
| foreach * [ eval <<FIELD>> = mvindex(<<FIELD>>,_count)]
| fields - _count

It counts fields dynamically, so it could be used anywhere.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...