Splunk Search

How to split a column into multiple columns?

dojiepreji
Path Finder

Hi,

I have a table that looks like this:

name       | count
score1and2 | 1
score1     | 2
score2     | 2
missed1and2| 3
missed1    | 2
missed2    | 2

I want to arrange the table like this:

name       | count     |  name       | count
score1and2 | 1         | missed1and2 | 3
score1     | 2         | missed1     | 2
score2     | 2         | missed2     | 2

I've tried using chart and tried different arrangements of by and over clauses but to no avail.
Any help would be appreciated. Thank you.

0 Karma

tomaszdziwok
Path Finder

Hi dopjiepreji,

Unfortunately, doing exactly what you want is impossible in Splunk. There is no way that you can have duplicate column names in standard SPL (although you might be able to do it in XML of a dashboard).

The following SPL should be very close to what you wanted, but it's a bit "hacky" so I wouldn't recommend this approach.

| search name=missed*
| sort name
| appendcols [
 | search name=score*
 | sort name
 | rename name as name1, count as count1
]
| table name, count, name1, count1

This search is slightly different from what you requested, but it is much more the "Splunk way".

| rex field=name "(?<class>missed|score)(?<type>.*)"
| stats sum(count) as count by type, class
| xyseries class, type, count

Hopefully you can find a way to make this work better with your real data. I had to use "|rex" to extract information from "name" in the sample you provided to get it working.

0 Karma
Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out &gt;&gt; Kudos to all the ...