Dashboards & Visualizations

how to display column data in multiple rows

nirmalya2006
Path Finder

Hi Splunkers

I have a table in the below format

Email, Name
email1, name1
email2, name2
email3, name3
email4, name4

I want to view the data in this format.

<no headers>
Email - email1
Name - name1
Email - email2
Name - name2
Email - email3
Name - name3
Email - email4
Name - name4

Can someone help me with the keywords or queries to be used

Thanks

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

hey I think you want something like this, try this run anywhere search

| makeresults 
| eval data="email1name1 email2name2 email3name3 email4name4 email5name5" 
| makemv data 
| mvexpand data 
| rex field=data "(?<Email>.{6})(?<Name>.{5})" 
| eval Email="Email"." - ".Email,Name="Name"." - ".Name 
| eval "no headers"=mvzip(Email,Name) 
| makemv "no headers" delim="," 
| mvexpand "no headers" 
| table "no headers" 
| rename "no headers" as " "

In your environment, you should try

<your table with Email and Name Columns> 
| eval Email="Email"." - ".Email,Name="Name"." - ".Name 
| eval "no headers"=mvzip(Email,Name) 
| makemv "no headers" delim="," 
| mvexpand "no headers" 
| table "no headers" 
| rename "no headers" as " "

let me know if this helps!

View solution in original post

mayurr98
Super Champion

hey I think you want something like this, try this run anywhere search

| makeresults 
| eval data="email1name1 email2name2 email3name3 email4name4 email5name5" 
| makemv data 
| mvexpand data 
| rex field=data "(?<Email>.{6})(?<Name>.{5})" 
| eval Email="Email"." - ".Email,Name="Name"." - ".Name 
| eval "no headers"=mvzip(Email,Name) 
| makemv "no headers" delim="," 
| mvexpand "no headers" 
| table "no headers" 
| rename "no headers" as " "

In your environment, you should try

<your table with Email and Name Columns> 
| eval Email="Email"." - ".Email,Name="Name"." - ".Name 
| eval "no headers"=mvzip(Email,Name) 
| makemv "no headers" delim="," 
| mvexpand "no headers" 
| table "no headers" 
| rename "no headers" as " "

let me know if this helps!

niketn
Legend

@nirmalya2006, can you try the following:

<YourBaseSearch>
| eval "Email - Name"= Email." - ".Name
| table "Email - Name"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...