Splunk Search

How to pivot data

Punnu
Path Finder

I have data like this 

   
id time Conatcts
x14/22/2011 10:00676689
x14/23/2011 11:00 

 

 

I want it like as shown below : Lw_mesage time is time when conatctid column is null  and other when conatcid column has value 

 

id lw_message_time standardised  message 
x14/23/2011 10:004/23/2011 11:00
Labels (2)
Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

First tag your event with one of two classes

| eval type=if(isnull(contactid),"lw_message","standardised_message")

And then do

| xyseries id type time
0 Karma
Get Updates on the Splunk Community!

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...

What’s New in Splunk Observability Cloud: January Feature Highlights & Deep Dives

Splunk Observability Cloud continues to evolve, empowering engineering and operations teams with advanced ...