Splunk Search

Splitting a column into two "even column index" and "odd column index"

akashtanova
Engager

Hello,
I have a column looking like this:

Value
1.234
2.456
7.223
0.765
...

Preliminary I know that each first row is X and the second is Y coordinates.
Therefore, I would like to get a table like that as a result:
X Y
1.234 2.456
7.223 0.765

Any suggestions?
Thank you.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

|makeresults | eval Value="1.234 2.456 7.223 0.765"
| table Value
| makemv Value
| mvexpand Value

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution."

| streamstats count AS _serial
| eval Field = if(_serial%2 = 1, "X", "Y")
| eval {Field} = Value
| table X Y
| streamstats count(X) AS sessionID
| selfjoin sessionID

View solution in original post

woodcock
Esteemed Legend

Like this:

|makeresults | eval Value="1.234 2.456 7.223 0.765"
| table Value
| makemv Value
| mvexpand Value

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution."

| streamstats count AS _serial
| eval Field = if(_serial%2 = 1, "X", "Y")
| eval {Field} = Value
| table X Y
| streamstats count(X) AS sessionID
| selfjoin sessionID

arjunpkishore5
Motivator

Try this

yoursearch
| eval row_num=1
| streamstats sum(row_num) as row_num
| eval grouper=row_num%2, row_num=ceil(row_num/2)
| stats max(eval(if(grouper==1,yourcolumn,null()))) as x, max(eval(if(grouper==0,yourcolumn,null()))) as y by row_num
| fields - row_num

Please upvote and mark as answer if this works for you

akashtanova
Engager

Also works. However, woodcock's answer fits for my particular task better. Thank you anyway.

0 Karma
Get Updates on the Splunk Community!

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...