Splunk Search

How to create a table with field value as column header, and another field value as the column value?

qxintuit
Engager

I have data like

1. {
    studentId: 1111
    subject: math
    grade: A
} 

2. {
    studentId: 1111
    subject: history
    grade: A
} 

3. {
    studentId: 2222
    subject: math
    grade: A
} 

4. {
    studentId: 2222
    subject: history
    grade: B
} 

and want to have output as

studentId            math .       history
1111                   A              A
2222                   A              B

I used something like

stats list(subject), list(grade) by studentId

But the result is not what I wanted... Can anyone please help me with an example or something? Thanks a lot!

Tags (2)
0 Karma
1 Solution

niketn
Legend

@qxintuit, try the following run anywhere search with sample data similar to your question:

| makeresults
| eval _raw="{\"students\":[ 
                {
                    \"studentId\": 1111,
                    \"subject\": \"math\",
                    \"grade\": \"A\"
                },
                {  
                    \"studentId\": 1111,
                    \"subject\": \"history\",
                    \"grade\": \"A\"
                },
                {
                    \"studentId\": 2222,
                    \"subject\": \"math\",
                    \"grade\": \"A\"
                },
                {
                    \"studentId\": 2222,
                    \"subject\": \"history\",
                    \"grade\": \"B\"
                } 
            ]
}"
| spath
| rename students{}.grade as grade
| rename students{}.studentId as studentId
| rename students{}.subject as subject
| eval students=mvzip(studentId,mvzip(subject,grade))
| fields students
| mvexpand students
| eval students=split(students,",")
| eval studentId=mvindex(students,0),subject =mvindex(students,1),grade =mvindex(students,2)
| fields - students _*
| chart last(grade) as grade over studentId by subject
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@qxintuit, try the following run anywhere search with sample data similar to your question:

| makeresults
| eval _raw="{\"students\":[ 
                {
                    \"studentId\": 1111,
                    \"subject\": \"math\",
                    \"grade\": \"A\"
                },
                {  
                    \"studentId\": 1111,
                    \"subject\": \"history\",
                    \"grade\": \"A\"
                },
                {
                    \"studentId\": 2222,
                    \"subject\": \"math\",
                    \"grade\": \"A\"
                },
                {
                    \"studentId\": 2222,
                    \"subject\": \"history\",
                    \"grade\": \"B\"
                } 
            ]
}"
| spath
| rename students{}.grade as grade
| rename students{}.studentId as studentId
| rename students{}.subject as subject
| eval students=mvzip(studentId,mvzip(subject,grade))
| fields students
| mvexpand students
| eval students=split(students,",")
| eval studentId=mvindex(students,0),subject =mvindex(students,1),grade =mvindex(students,2)
| fields - students _*
| chart last(grade) as grade over studentId by subject
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

qxintuit
Engager

@niketnilay, thank you so much!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...