Splunk Search

Splitting columns into rows

greg_cox1979
New Member

Hi Splunk Gurus,

I have an unusual requirement where I need to create two rows from one:

A | B | C |D | E

to

Row 1 - A | B | C | D
Row 2 - A | B | C | E

I think i could achieve this by using APPEND but the query is very complex so I dont want to have to run it twice unless maybe it can be referenced and then queried twice if that makes sense ?

Apologies in advance if I haven't made myself clear !

Thanks in advance,

Greg

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Generally you could do something like this, but can't be sure whether this will work for your use-case or not. Try these out and if it doesn't work, possible share you current search

your current search giving field A B C D E
| eval data=mvappend(D,E) | fields - D E
| mvexpand data
| table A B C data

View solution in original post

0 Karma

somesoni2
Revered Legend

Generally you could do something like this, but can't be sure whether this will work for your use-case or not. Try these out and if it doesn't work, possible share you current search

your current search giving field A B C D E
| eval data=mvappend(D,E) | fields - D E
| mvexpand data
| table A B C data
0 Karma

greg_cox1979
New Member

Thanks so much that worked with a little tweak:

your current search giving field A B C D E
| eval data=mvappend(D,E)
| mvexpand data
| table A B C data

Cheers !
Greg

0 Karma

niketn
Legend

@greg_cox1979 greg_cplease accept Somesh Soni's answer if your issue is resolved.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...