Splunk Search

Transpose or unpivot existing columns into other columns in a table

TreeHut
New Member

Is there away to un-pivot a couple columns and relocate them to an existing columns using an Eval expression inside the data model?

Here's the existing setup:

Column 1: Customer_Labels
First Name:
Last Name:
Address:

Column 2: Customer_Response
Blake's
Lotaburger
2529 Washington St NE

Column 3: City
Albuquerque:
Albuquerque:
Albuquerque:

Column 4: State
NM:
NM:
NM:

Column 5: LocationID
2
2
2

Here's the final layout moving City and State to columns 1 and column 2:

Column 1: Customer_Labels
First Name
Last Name
Address
City
State

Column 2: Customer_Response
Blake's
Lotaburger
2529 Washington St NE
Albuquerque
NM

Column 5: LocationID
2
2
2
2
2

The pivot report's layout would be a pivot of the LocationID and report Customer Reponses:

Customer_Labels 2
First Name: Blake's
Last Name: Lotaburger
Address: 2529 Washington St NE
City: Albuquerque
State: NM

I haven't been able to come up with some example code for your review. So I'm hopeful that there is an easy solution.

Thanks!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...