I'm trying to swap the roles of two columns. Normally, there is one "key" in the first column for every group of "values" in the second column. What if I want the values to become the keys? For instance, let's say the search "|index = dataname| table ColA, ColB" returns the following:
Col A Col B
John Seahawks, Lions, 49ers
Jason Titans, Seahawks, Dolphins
Rick Texans, Dolphins
I'd like the search redone. Should become
Col B Col A
Seahawks John, Jason
Lions John
49ers John
Titans Jason
Dolphins Jason, Rick
Texans Rick
Splunk statistics commands like stats timechart can split data by the sequence of the field names. So in order to reverse the columns you can try the following two commands
index = dataname
| stats count by ColA ColB
index = dataname
| stats count by ColB ColA