Splunk Search

Transpose or unpivot existing columns into other columns in a table

TreeHut
New Member

Is there away to un-pivot a couple columns and relocate them to an existing columns using an Eval expression inside the data model?

Here's the existing setup:

Column 1: Customer_Labels
First Name:
Last Name:
Address:

Column 2: Customer_Response
Blake's
Lotaburger
2529 Washington St NE

Column 3: City
Albuquerque:
Albuquerque:
Albuquerque:

Column 4: State
NM:
NM:
NM:

Column 5: LocationID
2
2
2

Here's the final layout moving City and State to columns 1 and column 2:

Column 1: Customer_Labels
First Name
Last Name
Address
City
State

Column 2: Customer_Response
Blake's
Lotaburger
2529 Washington St NE
Albuquerque
NM

Column 5: LocationID
2
2
2
2
2

The pivot report's layout would be a pivot of the LocationID and report Customer Reponses:

Customer_Labels 2
First Name: Blake's
Last Name: Lotaburger
Address: 2529 Washington St NE
City: Albuquerque
State: NM

I haven't been able to come up with some example code for your review. So I'm hopeful that there is an easy solution.

Thanks!

0 Karma
Get Updates on the Splunk Community!

Machine Learning - Assisted Adaptive Thresholding

Let’s talk thresholding. Have you set up static thresholds? Tired of static thresholds triggering false ...

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...