Splunk Search

How to split Data in one column to multiple columns?

himpor
Engager

hi,

I had the data in the following format

location        product        price
location1      Product1      price1
location1      product2      price2
location2      product1      price3
location2      product2      price4

I need to re-align it in following format

location       product1      product2
location1      price1          price2
location2      price3          price4

I can do it by splitting column by data model or pivot from base query. but is there any way for the using the SPL the following can be achieved.

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

your current search giving fields location product price
| xyseries location product price

See more about xyseries command here: http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Xyseries

View solution in original post

somesoni2
Revered Legend

Try like this

your current search giving fields location product price
| xyseries location product price

See more about xyseries command here: http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Xyseries

HiroshiSatoh
Champion

Try this!

(your search)
|table location product price
|eval {product}=price
|stats sum(product*) as product* by location
0 Karma

HiroshiSatoh
Champion

The answer of somesoni 2 is good.

 your current search giving fields location product price
 | xyseries location product price
 | stats sum(product*) as product* by location
0 Karma
Get Updates on the Splunk Community!

From GPU to Application: Monitoring Cisco AI Infrastructure with Splunk Observability ...

AI workloads are different. They demand specialized infrastructure—powerful GPUs, enterprise-grade networking, ...

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...