Splunk Search

How to move values on alternating rows onto the same row in my search results?

mrfredman
Path Finder

Hi,

I'm using postgres regex to pull two sets of values into my search. I've got all the data I want, but it seems to be on alternating lines.

In rows where column A is populated, column B is blank, and vice versa.

Is there any way to offset or align these values in splunk?

I would love to just move all the values of one column down by a row while leaving the other column as is.

Is this possible?

Tags (4)
0 Karma
1 Solution

mrfredman
Path Finder

I actually just came across a solution that worked for me. I think it's a bit hacky but it's getting me the results I need.

Solution:
streamstats first(fieldB) window=2

I have to do a bunch of other manipulation now, but that got me to the point where I was able to use more familiar splunk tools to get me what I need.

View solution in original post

mrfredman
Path Finder

I actually just came across a solution that worked for me. I think it's a bit hacky but it's getting me the results I need.

Solution:
streamstats first(fieldB) window=2

I have to do a bunch of other manipulation now, but that got me to the point where I was able to use more familiar splunk tools to get me what I need.

rsennett_splunk
Splunk Employee
Splunk Employee

I presume by "regex to pull two sets of values" you mean a eval foo = if(match(field,regex),thenThis,elseThat))

You need to provide a couple of example events and your search for us to help.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...