Splunk Search

How to move values on alternating rows onto the same row in my search results?

mrfredman
Path Finder

Hi,

I'm using postgres regex to pull two sets of values into my search. I've got all the data I want, but it seems to be on alternating lines.

In rows where column A is populated, column B is blank, and vice versa.

Is there any way to offset or align these values in splunk?

I would love to just move all the values of one column down by a row while leaving the other column as is.

Is this possible?

Tags (4)
0 Karma
1 Solution

mrfredman
Path Finder

I actually just came across a solution that worked for me. I think it's a bit hacky but it's getting me the results I need.

Solution:
streamstats first(fieldB) window=2

I have to do a bunch of other manipulation now, but that got me to the point where I was able to use more familiar splunk tools to get me what I need.

View solution in original post

mrfredman
Path Finder

I actually just came across a solution that worked for me. I think it's a bit hacky but it's getting me the results I need.

Solution:
streamstats first(fieldB) window=2

I have to do a bunch of other manipulation now, but that got me to the point where I was able to use more familiar splunk tools to get me what I need.

rsennett_splunk
Splunk Employee
Splunk Employee

I presume by "regex to pull two sets of values" you mean a eval foo = if(match(field,regex),thenThis,elseThat))

You need to provide a couple of example events and your search for us to help.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...