Splunk Search

How to combine multiple rows (from sub search results) into different columns on single row (main search)

Raymond2T
Path Finder
 

 

Column 1Column 2
A1A2
B1B2
C1C2
D1D2

 

And I would like to transform it to something like this

1st  row1st row2nd row 2nd row3 rd row 3rd row4th row4th row
A1A2B1B2 C1 C2 D1 D2

 

 

 

| makeresults
| eval _raw="Column1,Column2
A1,A2
B1,B2
C1,C2
D1,D2"
| multikv forceheader=1
| table Column1,Column2

|.......

 

 

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You can't have duplicate column names. To get the results in one row, try

| makeresults
| eval _raw="Column1,Column2
A1,A2
B1,B2
C1,C2
D1,D2"
| multikv forceheader=1
| table Column1,Column2
| streamstats count as row
| foreach * 
    [ eval columnvalues=if("<<FIELD>>"="row",columnvalues,if(isnull(columnvalues),<<FIELD>>,mvappend(columnvalues,<<FIELD>>)))]
| fields columnvalues
| mvexpand columnvalues
| transpose 0
| where column="columnvalues"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You can't have duplicate column names. To get the results in one row, try

| makeresults
| eval _raw="Column1,Column2
A1,A2
B1,B2
C1,C2
D1,D2"
| multikv forceheader=1
| table Column1,Column2
| streamstats count as row
| foreach * 
    [ eval columnvalues=if("<<FIELD>>"="row",columnvalues,if(isnull(columnvalues),<<FIELD>>,mvappend(columnvalues,<<FIELD>>)))]
| fields columnvalues
| mvexpand columnvalues
| transpose 0
| where column="columnvalues"

Raymond2T
Path Finder

Thank you so much. It is good solution  

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...