Splunk Search

Multiple Rows into one row with primary key

jimhill
Engager

Hi, 

I have data that looks like this (as you can see user_id 9 has filled numerous rows). This is just a csv ingested and being searched via lookup

user_idmeta_keymeta_value
9nickname341
9first_nameGilda
9last_nameLilia
9description 
9rich_editingTRUE
9syntax_highlightingTRUE
9comment_shortcutsFALSE
9bz_last_active202024300
9_sd_last_login2251532
9_jackqueline_persistent_cart_1a:1:{s:4:"cart";a:0:{}}
9_order_count0
9new_users_idXM00360
9antonettaa:0:{}
9rank_on_departureTAD 0fr Class
9phone_number12003601
9add_love1/120 CARSON ROAD
9last_name_01Lashawnda
9christina_code1100
9last_name_01_05Wendolyn
9birth_date05/00/0451
9countryStephania
9join_date13/02/2003
9Date_left1/05/2010
9full_namegilda lilia
9emailgilda_lilia@outlook.com

 

I really want the output to look like this, where the items in red, come on a single row linked to the unique user_id. At this stage i have over 3600 unique users, and on average, there are about 40 rows per user.

user_idfirst_namelast_namenew_users_idrank_on_departureadd_lovelast_name_01christina_codelast_name_01_05countryemail
9GildaLiliaXM00360TAD 0fr Class1/120 CARSON ROADLashawnda1100WendolynStephaniagilda_lilia@outlook.com
Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The first part (before the blank lines) just sets up your example data - the piece after the blank lines does the work - notice the by user_id on the stats command, this repeats the process for all your users.

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="user_id	meta_key	meta_value
9	nickname	341
9	first_name	Gilda
9	last_name	Lilia
9	description	 
9	rich_editing	TRUE
9	syntax_highlighting	TRUE
9	comment_shortcuts	FALSE
9	bz_last_active	202024300
9	_sd_last_login	2251532
9	_jackqueline_persistent_cart_1	a:1:{s:4:\"cart\";a:0:{}}
9	_order_count	0
9	new_users_id	XM00360
9	antonetta	a:0:{}
9	rank_on_departure	TAD 0fr Class
9	phone_number	12003601
9	add_love	1/120 CARSON ROAD
9	last_name_01	Lashawnda
9	christina_code	1100
9	last_name_01_05	Wendolyn
9	birth_date	05/00/0451
9	country	Stephania
9	join_date	13/02/2003
9	Date_left	1/05/2010
9	full_name	gilda lilia
9	email	gilda_lilia@outlook.com"
| multikv forceheader=1
| fields - linecount



| where match(meta_key, "first_name|last_name|new_users_id|rank_on_departure|add_love|last_name_01|christina_code|last_name_01_05|country|email")
| eval {meta_key}=meta_value
| fields - meta_key meta_value _raw
| stats values(*) as * by user_id
0 Karma

jimhill
Engager

Thank you so much. Thats perfect. 

Now how do I make it so that I can replicate it for all other users and bring it back in one spreadsheet. Is this achievable?

Thanks again

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The first part (before the blank lines) just sets up your example data - the piece after the blank lines does the work - notice the by user_id on the stats command, this repeats the process for all your users.

0 Karma

jimhill
Engager

Thank you so much. Extremely helpful

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...