Splunk Search

Splitting a column into two "even column index" and "odd column index"

akashtanova
Engager

Hello,
I have a column looking like this:

Value
1.234
2.456
7.223
0.765
...

Preliminary I know that each first row is X and the second is Y coordinates.
Therefore, I would like to get a table like that as a result:
X Y
1.234 2.456
7.223 0.765

Any suggestions?
Thank you.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

|makeresults | eval Value="1.234 2.456 7.223 0.765"
| table Value
| makemv Value
| mvexpand Value

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution."

| streamstats count AS _serial
| eval Field = if(_serial%2 = 1, "X", "Y")
| eval {Field} = Value
| table X Y
| streamstats count(X) AS sessionID
| selfjoin sessionID

View solution in original post

woodcock
Esteemed Legend

Like this:

|makeresults | eval Value="1.234 2.456 7.223 0.765"
| table Value
| makemv Value
| mvexpand Value

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution."

| streamstats count AS _serial
| eval Field = if(_serial%2 = 1, "X", "Y")
| eval {Field} = Value
| table X Y
| streamstats count(X) AS sessionID
| selfjoin sessionID

arjunpkishore5
Motivator

Try this

yoursearch
| eval row_num=1
| streamstats sum(row_num) as row_num
| eval grouper=row_num%2, row_num=ceil(row_num/2)
| stats max(eval(if(grouper==1,yourcolumn,null()))) as x, max(eval(if(grouper==0,yourcolumn,null()))) as y by row_num
| fields - row_num

Please upvote and mark as answer if this works for you

akashtanova
Engager

Also works. However, woodcock's answer fits for my particular task better. Thank you anyway.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...