Splunk Search

Expanding rows to certain number of rows

yuwtennis
Communicator

Hi!

I would like to get some help with search commands.
I have a result like,

string                     dT  count
1412175602_AAA_T1_32       4   1
1412125204_AAA_T1_34       2   3
1380813000_AAA_T2_50       16  2

In this situation I want to expand the rows of number of counts

string                     dT
1412175602_AAA_T1_32       4
1412125204_AAA_T1_34       2
1412125204_AAA_T1_34       2
1412125204_AAA_T1_34       2
1380813000_AAA_T2_50       16
1380813000_AAA_T2_50       16

Would there any way to do this?

Any help is appreciated!

Thanks,
Yu

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Append this to your search:

... | eval temp = replace(tostring(pow(10, count-1)), "(\d)", "\1,") | makemv temp delim="," | mvexpand temp | fields - temp
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...