Splunk Search

How to move values on alternating rows onto the same row in my search results?

mrfredman
Path Finder

Hi,

I'm using postgres regex to pull two sets of values into my search. I've got all the data I want, but it seems to be on alternating lines.

In rows where column A is populated, column B is blank, and vice versa.

Is there any way to offset or align these values in splunk?

I would love to just move all the values of one column down by a row while leaving the other column as is.

Is this possible?

Tags (4)
0 Karma
1 Solution

mrfredman
Path Finder

I actually just came across a solution that worked for me. I think it's a bit hacky but it's getting me the results I need.

Solution:
streamstats first(fieldB) window=2

I have to do a bunch of other manipulation now, but that got me to the point where I was able to use more familiar splunk tools to get me what I need.

View solution in original post

mrfredman
Path Finder

I actually just came across a solution that worked for me. I think it's a bit hacky but it's getting me the results I need.

Solution:
streamstats first(fieldB) window=2

I have to do a bunch of other manipulation now, but that got me to the point where I was able to use more familiar splunk tools to get me what I need.

rsennett_splunk
Splunk Employee
Splunk Employee

I presume by "regex to pull two sets of values" you mean a eval foo = if(match(field,regex),thenThis,elseThat))

You need to provide a couple of example events and your search for us to help.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

Transforming Financial Data into Fraud Intelligence

Every day, banks and financial companies handle millions of transactions, logins, and customer interactions ...

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...