Splunk Search
Highlighted

How to transform a table and use column headers as field values?

Motivator

Hi,

I would like to do a transformation like this:

alt text

Can you help how to achieve this?

Thanks in advance
Heinz

Highlighted

Re: How to transform a table and use column headers as field values?

Legend

Can you share the query for the first table

0 Karma
Highlighted

Re: How to transform a table and use column headers as field values?

Motivator

Unfortunately the first table would be the result of a csv

0 Karma
Highlighted

Re: How to transform a table and use column headers as field values?

SplunkTrust
SplunkTrust

Try something like this

Your current search giving table 1 | eval temp=name."#".department | fields - name department | untable temp month project | rex field=temp "(?<name>.*)#(?<department>.*)" | table name department month project

View solution in original post

Highlighted

Re: How to transform a table and use column headers as field values?

Motivator

Awesome, thanks a lot!

0 Karma