Splunk Search

how can i change column values to field names

kirrusk
Communicator

i'm trying to convert values in column to fields names, But not able to achieve.

table is like 

ENV       LABEL          APP

PR1       labelp1       APP1

PR1      labelp11     APP2

PR2      labelp2       APP1

PR2      labelp22    APP2

 

i'm trying to achieve

PR1                    PR2           APP

labelp1          labelp2        APP1

labelp11       labelp22     APP2

 

Can any one help on this

 

 

 

Labels (9)
0 Karma

mdorobek
Path Finder

Hello,

this might be a quick and dirty solution but it should work:

| ...
| stats values(LABEL) by ENV
| transpose header_field=ENV
| eval combine=mvzip(PR1,PR2,"|")
| fields combine
| mvexpand combine
| eval PR1=mvindex(split(combine,"|"), 0)
| eval PR2=mvindex(split(combine,"|"), 1)
| fields - combine

regards,
mdorobek

kirrusk
Communicator

@mdorobek  have updated question pls suggest on this

0 Karma

mdorobek
Path Finder

Hello,

heres the solution after the update:

 

 

...
| eval _raw=ENV+"="+LABEL
| extract
| stats values(PR1) as PR1 values(PR2) as PR2 by APP

 

However, this might need some further steps if you have multiple combinations of PR2/PR1 and App. 
If it doesnt solve your requirements a little more context would help to find the correct solution. 

Heres a possible solution, but you have to be aware, that this depends on the arrangement of your data and might not give correct results if you have another arrangement. 

 

| eval _raw=ENV+"="+LABEL
| extract
| stats values(PR1) as PR1 values(PR2) as PR2 by APP
| eval combined=mvzip(PR1,PR2,"|")
| fields - PR1, PR2
| mvexpand combined
| eval PR1=mvindex(split(combined,"|"),0)
| eval PR2=mvindex(split(combined,"|"),1)
| fields - combined

 

regards,
mdorobek

 

 

0 Karma

kirrusk
Communicator

@mdorobek  not working as expected , it is giving column like 

 

App        PR1           PR2

 App1   label11    label2

               label12    label21

                 ..                 ..

App2     labell1      label2

                label11    label22

 

 

    

 

0 Karma

mdorobek
Path Finder

Thats exactly what I meant with "However, this might need some further steps if you have multiple combinations of PR2/PR1 and App. " I updated the answer.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...