Splunk Search

Splitting a column into two "even column index" and "odd column index"

akashtanova
Engager

Hello,
I have a column looking like this:

Value
1.234
2.456
7.223
0.765
...

Preliminary I know that each first row is X and the second is Y coordinates.
Therefore, I would like to get a table like that as a result:
X Y
1.234 2.456
7.223 0.765

Any suggestions?
Thank you.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

|makeresults | eval Value="1.234 2.456 7.223 0.765"
| table Value
| makemv Value
| mvexpand Value

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution."

| streamstats count AS _serial
| eval Field = if(_serial%2 = 1, "X", "Y")
| eval {Field} = Value
| table X Y
| streamstats count(X) AS sessionID
| selfjoin sessionID

View solution in original post

woodcock
Esteemed Legend

Like this:

|makeresults | eval Value="1.234 2.456 7.223 0.765"
| table Value
| makemv Value
| mvexpand Value

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution."

| streamstats count AS _serial
| eval Field = if(_serial%2 = 1, "X", "Y")
| eval {Field} = Value
| table X Y
| streamstats count(X) AS sessionID
| selfjoin sessionID

arjunpkishore5
Motivator

Try this

yoursearch
| eval row_num=1
| streamstats sum(row_num) as row_num
| eval grouper=row_num%2, row_num=ceil(row_num/2)
| stats max(eval(if(grouper==1,yourcolumn,null()))) as x, max(eval(if(grouper==0,yourcolumn,null()))) as y by row_num
| fields - row_num

Please upvote and mark as answer if this works for you

akashtanova
Engager

Also works. However, woodcock's answer fits for my particular task better. Thank you anyway.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...