Splunk Search

Splitting a column into two "even column index" and "odd column index"

akashtanova
Engager

Hello,
I have a column looking like this:

Value
1.234
2.456
7.223
0.765
...

Preliminary I know that each first row is X and the second is Y coordinates.
Therefore, I would like to get a table like that as a result:
X Y
1.234 2.456
7.223 0.765

Any suggestions?
Thank you.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

|makeresults | eval Value="1.234 2.456 7.223 0.765"
| table Value
| makemv Value
| mvexpand Value

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution."

| streamstats count AS _serial
| eval Field = if(_serial%2 = 1, "X", "Y")
| eval {Field} = Value
| table X Y
| streamstats count(X) AS sessionID
| selfjoin sessionID

View solution in original post

woodcock
Esteemed Legend

Like this:

|makeresults | eval Value="1.234 2.456 7.223 0.765"
| table Value
| makemv Value
| mvexpand Value

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution."

| streamstats count AS _serial
| eval Field = if(_serial%2 = 1, "X", "Y")
| eval {Field} = Value
| table X Y
| streamstats count(X) AS sessionID
| selfjoin sessionID

arjunpkishore5
Motivator

Try this

yoursearch
| eval row_num=1
| streamstats sum(row_num) as row_num
| eval grouper=row_num%2, row_num=ceil(row_num/2)
| stats max(eval(if(grouper==1,yourcolumn,null()))) as x, max(eval(if(grouper==0,yourcolumn,null()))) as y by row_num
| fields - row_num

Please upvote and mark as answer if this works for you

akashtanova
Engager

Also works. However, woodcock's answer fits for my particular task better. Thank you anyway.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>