How to move values on alternating rows onto the same row in my search results?

[mrfredman]

Hi,

I'm using postgres regex to pull two sets of values into my search. I've got all the data I want, but it seems to be on alternating lines.

In rows where column A is populated, column B is blank, and vice versa.

Is there any way to offset or align these values in splunk?

I would love to just move all the values of one column down by a row while leaving the other column as is.

Is this possible?

[mrfredman · Accepted solution]

I actually just came across a solution that worked for me. I think it's a bit hacky but it's getting me the results I need.

Solution:
streamstats first(fieldB) window=2

I have to do a bunch of other manipulation now, but that got me to the point where I was able to use more familiar splunk tools to get me what I need.

[rsennett_splunk]

I presume by "regex to pull two sets of values" you mean a eval foo = if(match(field,regex),thenThis,elseThat))

You need to provide a couple of example events and your search for us to help.