topic Re: Transpose - Include data in column vs row in Splunk Enterprise

Transpose - Include data in column vs row

dglass0215 — Thu, 18 Jul 2024 20:59:28 GMT

Hello! Wondering if someone can help me fine tune my query. I have it very close but not quite what I want.

Here is my query in addition to screenshot of what the results currently look like:

[SomeSearch] | stats sum(FRCount) as totalHourCount by QSDateOfTxn, QSHourOfTxn limit=1000 | eval PPM = round(totalHourCount/60,2) | transpose 0 header_field=QSHourOfTxn

I would like the date to be a column (it is possible there would be multiple dates) but still show both totalHourCount and PPM as is per every hour.

Thanks,

David

Re: Transpose - Include data in column vs row

ITWhisperer — Thu, 18 Jul 2024 19:33:29 GMT

You could do something like this

Re: Transpose - Include data in column vs row

dglass0215 — Thu, 18 Jul 2024 19:38:44 GMT

First, let me say thank you! It certainly works and is exactly what I was looking for. But man, isn't there any other easier way? lol