Splunk Search

Is there a "zip_longest" like function in Splunk?

iiooiiooiioo
Explorer

I have this search/report:

host=app-dev-001 terminating OR rehire | convert timeformat="%Y-%m-%d" ctime(_time) AS date | table date rehire term_user

This gives me this result:

alt text

I would like to get term_user values to start showing up on row 1.

Is there something like python's zip_longest function?

import itertools
for u1, u2 in itertools.zip_longest(l1, l2):
...    print(u1, u2)
...    
omikusarl ahubshs
chasinnb egathnls
yeanvked mfdhaaar
kkldjuga iuvdcahe
aarehdv swusrbib
vikdho3n rcathrki
None jduakdf
None loidjht
Labels (1)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
host=app-dev-001 rehire 
| convert timeformat="%Y-%m-%d" ctime(_time) AS date 
| table date rehire 
| appendcols [search host=app-dev-001 terminating
| table term_user]
| fillnull rehire term_user value="None"

I don't know zip_longest. how about this?
If there is the key field, you can use stats.

View solution in original post

to4kawa
Ultra Champion
host=app-dev-001 rehire 
| convert timeformat="%Y-%m-%d" ctime(_time) AS date 
| table date rehire 
| appendcols [search host=app-dev-001 terminating
| table term_user]
| fillnull rehire term_user value="None"

I don't know zip_longest. how about this?
If there is the key field, you can use stats.

iiooiiooiioo
Explorer

awesome thanks! That's just what I needed.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...