How do you swap key/value pairs for two-column data?

[jturner900]

I'm trying to swap the roles of two columns. Normally, there is one "key" in the first column for every group of "values" in the second column. What if I want the values to become the keys? For instance, let's say the search "|index = dataname| table ColA, ColB" returns the following:

Col A Col B
John Seahawks, Lions, 49ers
Jason Titans, Seahawks, Dolphins
Rick Texans, Dolphins

I'd like the search redone. Should become

Col B Col A
Seahawks John, Jason
Lions John
49ers John
Titans Jason
Dolphins Jason, Rick
Texans Rick

[niketn]

Splunk statistics commands like stats timechart can split data by the sequence of the field names. So in order to reverse the columns you can try the following two commands

index = dataname
| stats count by ColA ColB

index = dataname
| stats count by ColB ColA