Splunk Search

Is there a "zip_longest" like function in Splunk?

iiooiiooiioo
Explorer

I have this search/report:

host=app-dev-001 terminating OR rehire | convert timeformat="%Y-%m-%d" ctime(_time) AS date | table date rehire term_user

This gives me this result:

alt text

I would like to get term_user values to start showing up on row 1.

Is there something like python's zip_longest function?

import itertools
for u1, u2 in itertools.zip_longest(l1, l2):
...    print(u1, u2)
...    
omikusarl ahubshs
chasinnb egathnls
yeanvked mfdhaaar
kkldjuga iuvdcahe
aarehdv swusrbib
vikdho3n rcathrki
None jduakdf
None loidjht
Labels (1)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
host=app-dev-001 rehire 
| convert timeformat="%Y-%m-%d" ctime(_time) AS date 
| table date rehire 
| appendcols [search host=app-dev-001 terminating
| table term_user]
| fillnull rehire term_user value="None"

I don't know zip_longest. how about this?
If there is the key field, you can use stats.

View solution in original post

to4kawa
Ultra Champion
host=app-dev-001 rehire 
| convert timeformat="%Y-%m-%d" ctime(_time) AS date 
| table date rehire 
| appendcols [search host=app-dev-001 terminating
| table term_user]
| fillnull rehire term_user value="None"

I don't know zip_longest. how about this?
If there is the key field, you can use stats.

iiooiiooiioo
Explorer

awesome thanks! That's just what I needed.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...