export stats value results into their own cells

[tve784]

So the source ip field in my results can have multiple results in it. Im trying to figure out how to get each one of those results put into their own cell when exporting to excel. with my current output it puts the source ip's in one cell on the bottom. i would like them to be in their own cells in that same column. Also if there is a way to sort the source ip's as well that would be even more awesome.

... | stats values(src_ip) by dest_port, protocol, dest_ip | sort +dest_port, dest_ip | transpose 1000000

[tve784]

is there a way to delete this question?

[tve784]

ok so im just going to can this idea if i can just figure out a way to sort the ip's that are within the "values(src_ip)" then i will be golden.

[felipesewaybric]

try something like | eval ip_something= coalesce(src_ip, dest_port, protocol, dest_ip)

coalesce is what i use on this cases.

http://blogs.splunk.com/2014/03/21/search-command-coalesce/

[tve784]

I don't think that will do much for what im trying to achieve. looking over the docs that is used to combine fields that arn't named the same into 1 field. All my fields are correct. I just need to output the source ip's one per cell in the csv that im exporting too.