Splunk Search

Expanding rows to certain number of rows

yuwtennis
Communicator

Hi!

I would like to get some help with search commands.
I have a result like,

string                     dT  count
1412175602_AAA_T1_32       4   1
1412125204_AAA_T1_34       2   3
1380813000_AAA_T2_50       16  2

In this situation I want to expand the rows of number of counts

string                     dT
1412175602_AAA_T1_32       4
1412125204_AAA_T1_34       2
1412125204_AAA_T1_34       2
1412125204_AAA_T1_34       2
1380813000_AAA_T2_50       16
1380813000_AAA_T2_50       16

Would there any way to do this?

Any help is appreciated!

Thanks,
Yu

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Append this to your search:

... | eval temp = replace(tostring(pow(10, count-1)), "(\d)", "\1,") | makemv temp delim="," | mvexpand temp | fields - temp
Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...