Splunk Search

transpose xyseries not helping

mukulraghuram
New Member

Need to transform like this. Please help.

Before:

  Col1----Col2
Name1----   a
    ------------b
--------c

After:`

Col1    Col2    Col3    Col4
Name1   a   b   c
Tags (2)
0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="col1 col2
Name1 a
      b
      c" 
| multikv forceheader=1
| table col1 col2
| eval tmp=mvappend(col1,col2)
| stats list(tmp) as tmp
| mvexpand tmp
| streamstats count
| eval cols="col".count
| xyseries count cols tmp
| eval count=1
| stats values(*) as * by count
| fields - count

It's not easy.

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...