Splunk Search

How to transform a table and use column headers as field values?

HeinzWaescher
Motivator

Hi,

I would like to do a transformation like this:

alt text

Can you help how to achieve this?

Thanks in advance
Heinz

1 Solution

somesoni2
Revered Legend

Try something like this

Your current search giving table 1 | eval temp=name."#".department | fields - name department | untable temp month project | rex field=temp "(?<name>.*)#(?<department>.*)" | table name department month project

View solution in original post

somesoni2
Revered Legend

Try something like this

Your current search giving table 1 | eval temp=name."#".department | fields - name department | untable temp month project | rex field=temp "(?<name>.*)#(?<department>.*)" | table name department month project

HeinzWaescher
Motivator

Awesome, thanks a lot!

0 Karma

sundareshr
Legend

Can you share the query for the first table

0 Karma

HeinzWaescher
Motivator

Unfortunately the first table would be the result of a csv

0 Karma
Get Updates on the Splunk Community!

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve ...

How to Send Splunk Observability Alerts to Webex teams in Minutes

As a Developer Evangelist at Splunk, my team and I are constantly tinkering with technology to explore its ...