TRANSFORMING TABLE

[nkankur]

I have data as given below in table format
A B C D E F
517 2498 186 1000 250 100
399 314 1559 100 100 1000

I want each row of D E and F against each row of A B and C kind of cross transformation
output should look like this:
A B C D E F
517 2498 186 1000 250 100
517 2498 186 100 100 1000
399 314 1559 1000 250 100
399 314 1559 100 100 1000

Thanks in advance!

[valiquet]

| eval row=A.B.C.D.F.",".A.B.C.D.F
| makemv delim="," row
| mvexpand row

[nkankur]

Thanks for your response, but this is not giving me required results.

[Richfez]

If I'm reading that correctly, any answer you get here has the distinct possibility that it will make your Splunk servers start sobbing uncontrollably.

In your two original events, you see you end up with four results.
If you repeated with three original events, you would end up with nine.
Four would end up sixteen...

By the time you a few hundred events, you might start having problems.

BUT this is OK, I just wanted to be clear about possible side effects and be sure that you know what you are asking?

[nkankur]

Hi,

I understood your point. But actually, my original data has fixed and fewer events hence this kind of issue is not going to affect my splunk servers. 🙂

[Richfez]

Great! Some folks don't always think everything through to the end, so I'm glad you have already done so!

(And sometimes it's worth noting specifically so someone else with unbounded results might be forewarned just a bit that they'll have to use care with this solution... 🙂 )

Happy Splunking!