Splunk Search

Splitting columns into rows

greg_cox1979
New Member

Hi Splunk Gurus,

I have an unusual requirement where I need to create two rows from one:

A | B | C |D | E

to

Row 1 - A | B | C | D
Row 2 - A | B | C | E

I think i could achieve this by using APPEND but the query is very complex so I dont want to have to run it twice unless maybe it can be referenced and then queried twice if that makes sense ?

Apologies in advance if I haven't made myself clear !

Thanks in advance,

Greg

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Generally you could do something like this, but can't be sure whether this will work for your use-case or not. Try these out and if it doesn't work, possible share you current search

your current search giving field A B C D E
| eval data=mvappend(D,E) | fields - D E
| mvexpand data
| table A B C data

View solution in original post

0 Karma

somesoni2
Revered Legend

Generally you could do something like this, but can't be sure whether this will work for your use-case or not. Try these out and if it doesn't work, possible share you current search

your current search giving field A B C D E
| eval data=mvappend(D,E) | fields - D E
| mvexpand data
| table A B C data
0 Karma

greg_cox1979
New Member

Thanks so much that worked with a little tweak:

your current search giving field A B C D E
| eval data=mvappend(D,E)
| mvexpand data
| table A B C data

Cheers !
Greg

0 Karma

niketn
Legend

@greg_cox1979 greg_cplease accept Somesh Soni's answer if your issue is resolved.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...