Splunk Search

How to combine multiple rows (from sub search results) into different columns on single row (main search)

Raymond2T
Path Finder
 

 

Column 1Column 2
A1A2
B1B2
C1C2
D1D2

 

And I would like to transform it to something like this

1st  row1st row2nd row 2nd row3 rd row 3rd row4th row4th row
A1A2B1B2 C1 C2 D1 D2

 

 

 

| makeresults
| eval _raw="Column1,Column2
A1,A2
B1,B2
C1,C2
D1,D2"
| multikv forceheader=1
| table Column1,Column2

|.......

 

 

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You can't have duplicate column names. To get the results in one row, try

| makeresults
| eval _raw="Column1,Column2
A1,A2
B1,B2
C1,C2
D1,D2"
| multikv forceheader=1
| table Column1,Column2
| streamstats count as row
| foreach * 
    [ eval columnvalues=if("<<FIELD>>"="row",columnvalues,if(isnull(columnvalues),<<FIELD>>,mvappend(columnvalues,<<FIELD>>)))]
| fields columnvalues
| mvexpand columnvalues
| transpose 0
| where column="columnvalues"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You can't have duplicate column names. To get the results in one row, try

| makeresults
| eval _raw="Column1,Column2
A1,A2
B1,B2
C1,C2
D1,D2"
| multikv forceheader=1
| table Column1,Column2
| streamstats count as row
| foreach * 
    [ eval columnvalues=if("<<FIELD>>"="row",columnvalues,if(isnull(columnvalues),<<FIELD>>,mvappend(columnvalues,<<FIELD>>)))]
| fields columnvalues
| mvexpand columnvalues
| transpose 0
| where column="columnvalues"

Raymond2T
Path Finder

Thank you so much. It is good solution  

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...