Splunk Search

How to transform a table and use column headers as field values?

HeinzWaescher
Motivator

Hi,

I would like to do a transformation like this:

alt text

Can you help how to achieve this?

Thanks in advance
Heinz

1 Solution

somesoni2
Revered Legend

Try something like this

Your current search giving table 1 | eval temp=name."#".department | fields - name department | untable temp month project | rex field=temp "(?<name>.*)#(?<department>.*)" | table name department month project

View solution in original post

somesoni2
Revered Legend

Try something like this

Your current search giving table 1 | eval temp=name."#".department | fields - name department | untable temp month project | rex field=temp "(?<name>.*)#(?<department>.*)" | table name department month project

HeinzWaescher
Motivator

Awesome, thanks a lot!

0 Karma

sundareshr
Legend

Can you share the query for the first table

0 Karma

HeinzWaescher
Motivator

Unfortunately the first table would be the result of a csv

0 Karma
Get Updates on the Splunk Community!

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...

Out of the Box to Up And Running - Streamlined Observability for Your Cloud ...

  Tech Talk Streamlined Observability for Your Cloud Environment Register    Out of the Box to Up And Running ...

Splunk Smartness with Brandon Sternfield | Episode 3

Hello and welcome to another episode of "Splunk Smartness," the interview series where we explore the power of ...