Splunk Search

Splitting columns into rows

greg_cox1979
New Member

Hi Splunk Gurus,

I have an unusual requirement where I need to create two rows from one:

A | B | C |D | E

to

Row 1 - A | B | C | D
Row 2 - A | B | C | E

I think i could achieve this by using APPEND but the query is very complex so I dont want to have to run it twice unless maybe it can be referenced and then queried twice if that makes sense ?

Apologies in advance if I haven't made myself clear !

Thanks in advance,

Greg

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Generally you could do something like this, but can't be sure whether this will work for your use-case or not. Try these out and if it doesn't work, possible share you current search

your current search giving field A B C D E
| eval data=mvappend(D,E) | fields - D E
| mvexpand data
| table A B C data

View solution in original post

0 Karma

somesoni2
Revered Legend

Generally you could do something like this, but can't be sure whether this will work for your use-case or not. Try these out and if it doesn't work, possible share you current search

your current search giving field A B C D E
| eval data=mvappend(D,E) | fields - D E
| mvexpand data
| table A B C data
0 Karma

greg_cox1979
New Member

Thanks so much that worked with a little tweak:

your current search giving field A B C D E
| eval data=mvappend(D,E)
| mvexpand data
| table A B C data

Cheers !
Greg

0 Karma

niketn
Legend

@greg_cox1979 greg_cplease accept Somesh Soni's answer if your issue is resolved.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...