Splunk Search

## Put fields results under other fields

Contributor

Hi,

I have my query that return a table with 4 fields: A1, B1, A2, A2. I want to create a new table that contains 2 fields: A and B.

example:
current table -

desired table -

I would like to achieve that without running on the events again and append the results.

is there an efficient way to do that?

thanks

Tags (3)
1 Solution
Super Champion

hey try this run anywhere search

``````| makeresults
| eval A1="1",B1="2",A2="3",B2="4"
| append
[| makeresults
| eval A1="5",B1="6",A2="7",B2="8"]
| append
[| makeresults
| eval A1="9",B1="10",A2="10",B2="11"]
| eval A=A1+":"+B1,B=A2+":"+B2
| table A B
| eval C=mvzip(A,B)
| makemv delim="," C
| mvexpand C
| rex field=C "(?<A>[^\:]+)\:(?<B>.*)"
| table A B
``````

In your environment, you should try

``````<table with columns A1,A2,B1,B2>
| eval A=A1+":"+B1,B=A2+":"+B2
| table A B
| eval C=mvzip(A,B)
| makemv delim="," C
| mvexpand C
| rex field=C "(?<A>[^\:]+)\:(?<B>.*)"
| table A B
``````

let me know if this helps!

Super Champion

hey try this run anywhere search

``````| makeresults
| eval A1="1",B1="2",A2="3",B2="4"
| append
[| makeresults
| eval A1="5",B1="6",A2="7",B2="8"]
| append
[| makeresults
| eval A1="9",B1="10",A2="10",B2="11"]
| eval A=A1+":"+B1,B=A2+":"+B2
| table A B
| eval C=mvzip(A,B)
| makemv delim="," C
| mvexpand C
| rex field=C "(?<A>[^\:]+)\:(?<B>.*)"
| table A B
``````

In your environment, you should try

``````<table with columns A1,A2,B1,B2>
| eval A=A1+":"+B1,B=A2+":"+B2
| table A B
| eval C=mvzip(A,B)
| makemv delim="," C
| mvexpand C
| rex field=C "(?<A>[^\:]+)\:(?<B>.*)"
| table A B
``````

let me know if this helps!

Contributor

great workaround! thanks

Get Updates on the Splunk Community!

#### There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

#### The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out &gt;&gt; &#x1f3c6; Check out the ...

#### Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...