Need help with the format of the fields in splunk query

[bhartiya008]

I have the final result which looks like below:

Host   Date        Total_1   Total_2      To_be_removed
Prod   02-26-2021   456        784         [X,Y,Z]

I want something like below :

Host   Date             Summary
Prod  02-26-2021         Total_1:456
                         Total_2:784
	                 To_be_removed:[X,Y,Z]

 How Can I achieve this in splunk search query?

[ITWhisperer · Accepted solution]

| makeresults | eval _raw="Host   Date        Total_1   Total_2      To_be_removed
Prod   02-26-2021   456        784         [X,Y,Z]"
| multikv forceheader=1
| fields - _raw _time linecount
| foreach * [
  | eval Summary=if("<<FIELD>>" != "Host" AND "<<FIELD>>" != "Date", mvappend(Summary,"<<FIELD>>".":".<<FIELD>>),Summary)
]
| fields Date Host Summary

Main issue with this is that the fields are processed in alphabetic order due to the * - if you want to a specific order, you could do

| makeresults | eval _raw="Host   Date        Total_1   Total_2      To_be_removed
Prod   02-26-2021   456        784         [X,Y,Z]"
| multikv forceheader=1
| fields - _raw _time linecount
| foreach Total_* To_be_removed [
  | eval Summary=mvappend(Summary,"<<FIELD>>".":".<<FIELD>>)
]
| fields Date Host Summary

[bhartiya008]

Thanks @ITWhisperer  So do I have to add the below lines of code:

| multikv forceheader=1
| fields - _raw _time linecount
| foreach Total_* To_be_removed [
  | eval Summary=mvappend(Summary,"<<FIELD>>".":".<<FIELD>>)
]
| fields Date Host Summary

The last line in my query is | fields + < field_names>

[ITWhisperer]

Just add from (and including) the foreach command - everything prior to that is me setting up a run-anywhere example showing how your example data could be processed.

[bhartiya008]

@ITWhisperer  This works like a charm!! Thanks Much!!