topic Re: Splunk query- need customised in Splunk Enterprise

Help with reformatting Splunk Search

Vani_26 — Thu, 08 Sep 2022 05:50:45 GMT

Query:
|tstats avg(PREFIX(prtime)) as avg(prtime) where index=xdf source=sdsf TERM(pght=eff) OR TERM(pght=dfrg) OR TERM(pght=iojb) by PREFIX(pght=) _time span=1m

|rename pght= as Pght

this query is working fine and getting the results in below format:
Pght _time avg(prtime)

eff 2022-09-07 13:00:00 40.667889889

dfrg 2022-09-07 13:01:00 75.678

iojb 2022-09-07 13:02:00 54.765423

but i want the results in below format

_time eff dfrg iojb

2022-09-07 13:00:00 40.667889889 75.678 80.87656

2022-09-07 13:01:00 34.879 64.897 66.8765

2022-09-07 13:02:00 67.989 89.09876 67.985

please let me know how to do this.

Re: Splunk query- need customised

diogofgm — Wed, 07 Sep 2022 23:03:05 GMT

Just add a timechart command

| timechart values("avg(prtime)") by Pght

Re: Splunk query- need customised

Vani_26 — Thu, 08 Sep 2022 17:04:23 GMT

@diogofgm , Thank you, it worked as expected.

i have one more the same, can u please help on this as well.

Query:
|tstats count where index=dfg source=htghy TERM(group=bxnbxnx) TERM(group=ghgjhb) by PREFIX(pstatus=) _time

|rename pstatus= as Pstatus

Pstatus _time count

fail 2022-09-01 89

fail 2022-09-02 56

fail 2022-09-03 123

pass 2022-09-04 67

pass 2022-09-05 78

pass 2022-09-06 678

pass 2022-09-07 1414

but i want in the below format:

_time pass fail

2022-09-01 34 16

2022-09-02 44 33

2022-09-03 80 20

2022-09-04 56 22

Re: Splunk query- need customised

diogofgm — Thu, 08 Sep 2022 23:35:06 GMT

Same logic as the previous one

|timechart values(count) by Pstatus