Hi Splunkers
I have a table in the below format
Email, Name
email1, name1
email2, name2
email3, name3
email4, name4
I want to view the data in this format.
<no headers>
Email - email1
Name - name1
Email - email2
Name - name2
Email - email3
Name - name3
Email - email4
Name - name4
Can someone help me with the keywords or queries to be used
Thanks
hey I think you want something like this, try this run anywhere search
| makeresults
| eval data="email1name1 email2name2 email3name3 email4name4 email5name5"
| makemv data
| mvexpand data
| rex field=data "(?<Email>.{6})(?<Name>.{5})"
| eval Email="Email"." - ".Email,Name="Name"." - ".Name
| eval "no headers"=mvzip(Email,Name)
| makemv "no headers" delim=","
| mvexpand "no headers"
| table "no headers"
| rename "no headers" as " "
In your environment, you should try
<your table with Email and Name Columns>
| eval Email="Email"." - ".Email,Name="Name"." - ".Name
| eval "no headers"=mvzip(Email,Name)
| makemv "no headers" delim=","
| mvexpand "no headers"
| table "no headers"
| rename "no headers" as " "
let me know if this helps!
hey I think you want something like this, try this run anywhere search
| makeresults
| eval data="email1name1 email2name2 email3name3 email4name4 email5name5"
| makemv data
| mvexpand data
| rex field=data "(?<Email>.{6})(?<Name>.{5})"
| eval Email="Email"." - ".Email,Name="Name"." - ".Name
| eval "no headers"=mvzip(Email,Name)
| makemv "no headers" delim=","
| mvexpand "no headers"
| table "no headers"
| rename "no headers" as " "
In your environment, you should try
<your table with Email and Name Columns>
| eval Email="Email"." - ".Email,Name="Name"." - ".Name
| eval "no headers"=mvzip(Email,Name)
| makemv "no headers" delim=","
| mvexpand "no headers"
| table "no headers"
| rename "no headers" as " "
let me know if this helps!
@nirmalya2006, can you try the following:
<YourBaseSearch>
| eval "Email - Name"= Email." - ".Name
| table "Email - Name"