Splunk Search

TRANSFORMING TABLE

nkankur
Path Finder

I have data as given below in table format
A B C D E F
517 2498 186 1000 250 100
399 314 1559 100 100 1000

I want each row of D E and F against each row of A B and C kind of cross transformation
output should look like this:
A B C D E F
517 2498 186 1000 250 100
517 2498 186 100 100 1000
399 314 1559 1000 250 100
399 314 1559 100 100 1000

Thanks in advance!

0 Karma

valiquet
Contributor

| eval row=A.B.C.D.F.",".A.B.C.D.F
| makemv delim="," row
| mvexpand row

0 Karma

nkankur
Path Finder

Thanks for your response, but this is not giving me required results.

0 Karma

Richfez
SplunkTrust
SplunkTrust

If I'm reading that correctly, any answer you get here has the distinct possibility that it will make your Splunk servers start sobbing uncontrollably.

In your two original events, you see you end up with four results.
If you repeated with three original events, you would end up with nine.
Four would end up sixteen...

By the time you a few hundred events, you might start having problems.

BUT this is OK, I just wanted to be clear about possible side effects and be sure that you know what you are asking?

0 Karma

nkankur
Path Finder

Hi,

I understood your point. But actually, my original data has fixed and fewer events hence this kind of issue is not going to affect my splunk servers. 🙂

0 Karma

Richfez
SplunkTrust
SplunkTrust

Great! Some folks don't always think everything through to the end, so I'm glad you have already done so!

(And sometimes it's worth noting specifically so someone else with unbounded results might be forewarned just a bit that they'll have to use care with this solution... 🙂 )

Happy Splunking!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...