Splunk Search

Multiple Rows into one row with primary key

jimhill
Engager

Hi, 

I have data that looks like this (as you can see user_id 9 has filled numerous rows). This is just a csv ingested and being searched via lookup

user_idmeta_keymeta_value
9nickname341
9first_nameGilda
9last_nameLilia
9description 
9rich_editingTRUE
9syntax_highlightingTRUE
9comment_shortcutsFALSE
9bz_last_active202024300
9_sd_last_login2251532
9_jackqueline_persistent_cart_1a:1:{s:4:"cart";a:0:{}}
9_order_count0
9new_users_idXM00360
9antonettaa:0:{}
9rank_on_departureTAD 0fr Class
9phone_number12003601
9add_love1/120 CARSON ROAD
9last_name_01Lashawnda
9christina_code1100
9last_name_01_05Wendolyn
9birth_date05/00/0451
9countryStephania
9join_date13/02/2003
9Date_left1/05/2010
9full_namegilda lilia
9emailgilda_lilia@outlook.com

 

I really want the output to look like this, where the items in red, come on a single row linked to the unique user_id. At this stage i have over 3600 unique users, and on average, there are about 40 rows per user.

user_idfirst_namelast_namenew_users_idrank_on_departureadd_lovelast_name_01christina_codelast_name_01_05countryemail
9GildaLiliaXM00360TAD 0fr Class1/120 CARSON ROADLashawnda1100WendolynStephaniagilda_lilia@outlook.com
Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The first part (before the blank lines) just sets up your example data - the piece after the blank lines does the work - notice the by user_id on the stats command, this repeats the process for all your users.

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="user_id	meta_key	meta_value
9	nickname	341
9	first_name	Gilda
9	last_name	Lilia
9	description	 
9	rich_editing	TRUE
9	syntax_highlighting	TRUE
9	comment_shortcuts	FALSE
9	bz_last_active	202024300
9	_sd_last_login	2251532
9	_jackqueline_persistent_cart_1	a:1:{s:4:\"cart\";a:0:{}}
9	_order_count	0
9	new_users_id	XM00360
9	antonetta	a:0:{}
9	rank_on_departure	TAD 0fr Class
9	phone_number	12003601
9	add_love	1/120 CARSON ROAD
9	last_name_01	Lashawnda
9	christina_code	1100
9	last_name_01_05	Wendolyn
9	birth_date	05/00/0451
9	country	Stephania
9	join_date	13/02/2003
9	Date_left	1/05/2010
9	full_name	gilda lilia
9	email	gilda_lilia@outlook.com"
| multikv forceheader=1
| fields - linecount



| where match(meta_key, "first_name|last_name|new_users_id|rank_on_departure|add_love|last_name_01|christina_code|last_name_01_05|country|email")
| eval {meta_key}=meta_value
| fields - meta_key meta_value _raw
| stats values(*) as * by user_id
0 Karma

jimhill
Engager

Thank you so much. Thats perfect. 

Now how do I make it so that I can replicate it for all other users and bring it back in one spreadsheet. Is this achievable?

Thanks again

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The first part (before the blank lines) just sets up your example data - the piece after the blank lines does the work - notice the by user_id on the stats command, this repeats the process for all your users.

0 Karma

jimhill
Engager

Thank you so much. Extremely helpful

0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...