Splunk Search
Highlighted

Is there a "zip_longest" like function in Splunk?

Explorer

I have this search/report:

host=app-dev-001 terminating OR rehire | convert timeformat="%Y-%m-%d" ctime(_time) AS date | table date rehire term_user

This gives me this result:

alt text

I would like to get term_user values to start showing up on row 1.

Is there something like python's zip_longest function?

import itertools
for u1, u2 in itertools.zip_longest(l1, l2):
...    print(u1, u2)
...    
omikusarl ahubshs
chasinnb egathnls
yeanvked mfdhaaar
kkldjuga iuvdcahe
aarehdv swusrbib
vikdho3n rcathrki
None jduakdf
None loidjht
Labels (1)
Tags (1)
0 Karma
Highlighted

Re: Is there a "zip_longest" like function in Splunk?

Ultra Champion
host=app-dev-001 rehire 
| convert timeformat="%Y-%m-%d" ctime(_time) AS date 
| table date rehire 
| appendcols [search host=app-dev-001 terminating
| table term_user]
| fillnull rehire term_user value="None"

I don't know zip_longest. how about this?
If there is the key field, you can use stats.

View solution in original post

Highlighted

Re: Is there a "zip_longest" like function in Splunk?

Explorer

awesome thanks! That's just what I needed.

0 Karma