Splunk Search

Transpose or unpivot existing columns into other columns in a table

TreeHut
New Member

Is there away to un-pivot a couple columns and relocate them to an existing columns using an Eval expression inside the data model?

Here's the existing setup:

Column 1: Customer_Labels
First Name:
Last Name:
Address:

Column 2: Customer_Response
Blake's
Lotaburger
2529 Washington St NE

Column 3: City
Albuquerque:
Albuquerque:
Albuquerque:

Column 4: State
NM:
NM:
NM:

Column 5: LocationID
2
2
2

Here's the final layout moving City and State to columns 1 and column 2:

Column 1: Customer_Labels
First Name
Last Name
Address
City
State

Column 2: Customer_Response
Blake's
Lotaburger
2529 Washington St NE
Albuquerque
NM

Column 5: LocationID
2
2
2
2
2

The pivot report's layout would be a pivot of the LocationID and report Customer Reponses:

Customer_Labels 2
First Name: Blake's
Last Name: Lotaburger
Address: 2529 Washington St NE
City: Albuquerque
State: NM

I haven't been able to come up with some example code for your review. So I'm hopeful that there is an easy solution.

Thanks!

0 Karma
Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...