How to make the values in a column the column names for a table?

[chrismok]

Hi all,

I would like to make the values of a column the column names for a table.

Currently, I am using the command to get the result

......|table Job SubJob Action Value

And I would like to make the "action" column value to be a column name. In addition, if the action=result and value is True, it returns "Success", if it is "false", it returns "Failed", otherwise, it returns "In Progress".

The result is similar like that.

[rtoloczk]

Here is another solution I came across https://community.splunk.com/t5/Splunk-Search/Field-results-as-table-column-headings/m-p/66771

that might work. It's using the chart command. 

[tom_frotscher · Accepted solution]

Hi,

there might be an easier way, because this is pretty complicated / complex. But maybe you can go on from here:

| inputlookup answers.csv | stats list(*) by Job | eval fields = mvzip('list(Action)','list(Value)') | mvexpand fields | rex field=fields "start\,(?<Start>.*)" | rex field=fields "end\,(?<End>.*)" | rex field=fields "remark\,(?<Remark>.*)" | eval Result=if(mvfind('list(Action)',"result")>= 0 AND mvfind('list(Value)',"TRUE")>= 0,"Success",if(mvfind('list(Action)',"result")>= 0 AND mvfind('list(Value)',"FALSE")>= 0,"Failed","In Progress")) | table Job Start End Result Remark | stats list(*) by Job | mvexpand list(Result) | dedup Job | rename list(End) AS End list(Start) as Start list(Result) as Result list(Remark) as Remark | eval Time=((strptime(End, "%H:%M") - strptime(Start, "%H:%M")) / 60)." min" | table Job Start End Time Result Remark

I used the inputlookup to get the table you mentioned as starting point. You have to replace the inputlookup by your search untill your table command.