Splunk Search

How to split a column into multiple columns?

dojiepreji
Path Finder

Hi,

I have a table that looks like this:

name       | count
score1and2 | 1
score1     | 2
score2     | 2
missed1and2| 3
missed1    | 2
missed2    | 2

I want to arrange the table like this:

name       | count     |  name       | count
score1and2 | 1         | missed1and2 | 3
score1     | 2         | missed1     | 2
score2     | 2         | missed2     | 2

I've tried using chart and tried different arrangements of by and over clauses but to no avail.
Any help would be appreciated. Thank you.

0 Karma

tomaszdziwok
Path Finder

Hi dopjiepreji,

Unfortunately, doing exactly what you want is impossible in Splunk. There is no way that you can have duplicate column names in standard SPL (although you might be able to do it in XML of a dashboard).

The following SPL should be very close to what you wanted, but it's a bit "hacky" so I wouldn't recommend this approach.

| search name=missed*
| sort name
| appendcols [
 | search name=score*
 | sort name
 | rename name as name1, count as count1
]
| table name, count, name1, count1

This search is slightly different from what you requested, but it is much more the "Splunk way".

| rex field=name "(?<class>missed|score)(?<type>.*)"
| stats sum(count) as count by type, class
| xyseries class, type, count

Hopefully you can find a way to make this work better with your real data. I had to use "|rex" to extract information from "name" in the sample you provided to get it working.

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...