Splunk Search

Transpose or unpivot existing columns into other columns in a table

TreeHut
New Member

Is there away to un-pivot a couple columns and relocate them to an existing columns using an Eval expression inside the data model?

Here's the existing setup:

Column 1: Customer_Labels
First Name:
Last Name:
Address:

Column 2: Customer_Response
Blake's
Lotaburger
2529 Washington St NE

Column 3: City
Albuquerque:
Albuquerque:
Albuquerque:

Column 4: State
NM:
NM:
NM:

Column 5: LocationID
2
2
2

Here's the final layout moving City and State to columns 1 and column 2:

Column 1: Customer_Labels
First Name
Last Name
Address
City
State

Column 2: Customer_Response
Blake's
Lotaburger
2529 Washington St NE
Albuquerque
NM

Column 5: LocationID
2
2
2
2
2

The pivot report's layout would be a pivot of the LocationID and report Customer Reponses:

Customer_Labels 2
First Name: Blake's
Last Name: Lotaburger
Address: 2529 Washington St NE
City: Albuquerque
State: NM

I haven't been able to come up with some example code for your review. So I'm hopeful that there is an easy solution.

Thanks!

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...