Splunk Search

Is there a "zip_longest" like function in Splunk?

iiooiiooiioo
Explorer

I have this search/report:

host=app-dev-001 terminating OR rehire | convert timeformat="%Y-%m-%d" ctime(_time) AS date | table date rehire term_user

This gives me this result:

alt text

I would like to get term_user values to start showing up on row 1.

Is there something like python's zip_longest function?

import itertools
for u1, u2 in itertools.zip_longest(l1, l2):
...    print(u1, u2)
...    
omikusarl ahubshs
chasinnb egathnls
yeanvked mfdhaaar
kkldjuga iuvdcahe
aarehdv swusrbib
vikdho3n rcathrki
None jduakdf
None loidjht
Labels (1)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
host=app-dev-001 rehire 
| convert timeformat="%Y-%m-%d" ctime(_time) AS date 
| table date rehire 
| appendcols [search host=app-dev-001 terminating
| table term_user]
| fillnull rehire term_user value="None"

I don't know zip_longest. how about this?
If there is the key field, you can use stats.

View solution in original post

to4kawa
Ultra Champion
host=app-dev-001 rehire 
| convert timeformat="%Y-%m-%d" ctime(_time) AS date 
| table date rehire 
| appendcols [search host=app-dev-001 terminating
| table term_user]
| fillnull rehire term_user value="None"

I don't know zip_longest. how about this?
If there is the key field, you can use stats.

iiooiiooiioo
Explorer

awesome thanks! That's just what I needed.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...