Splunk Search

How do you swap key/value pairs for two-column data?

jturner900
Explorer

I'm trying to swap the roles of two columns. Normally, there is one "key" in the first column for every group of "values" in the second column. What if I want the values to become the keys? For instance, let's say the search "|index = dataname| table ColA, ColB" returns the following:

Col A Col B
John Seahawks, Lions, 49ers
Jason Titans, Seahawks, Dolphins
Rick Texans, Dolphins

I'd like the search redone. Should become

Col B Col A
Seahawks John, Jason
Lions John
49ers John
Titans Jason
Dolphins Jason, Rick
Texans Rick

Tags (4)
0 Karma

niketn
Legend

Splunk statistics commands like stats timechart can split data by the sequence of the field names. So in order to reverse the columns you can try the following two commands

index = dataname
| stats count by ColA ColB

index = dataname
| stats count by ColB ColA 
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...