topic Re: How can I convert column value to column? in Splunk Search

How can I convert column value to column?

liondancer — Mon, 21 May 2018 19:43:32 GMT

I have the following output from my query:

**Search Query** | eval DateHour=year."-".month."-".day."-".hour | chart event_count BY DateHour, zone

DateHour      |  event_count              |  zone
2018-04-10              14                     A
2018-04-10              14                     B
2018-04-11              18                     A
2018-04-11              18                     B

What can I do to convert my table to something like this:

DateHour              |  A                |     B
2018-04-10              14                     14
2018-04-11              18                     18

Re: How can I convert column value to column?

somesoni2 — Mon, 21 May 2018 21:40:42 GMT

Are you sure you're using chart command like the one you showed (probably missing aggregate function)? If your chart command is ...| chart <<some aggregation>> BY DateHour zone, then you should get the output#2 which you need. You're not using stats right?

Re: How can I convert column value to column?

mayurr98 — Tue, 22 May 2018 06:04:01 GMT

Try this

<your_base_query_to_get_first_output>| chart values(event_count) over date_hour by zone

let me know if this helps!

Re: How can I convert column value to column?

harishalipaka — Tue, 22 May 2018 07:11:07 GMT

| makeresults | eval DateHour="2018-04-10" 
| eval event_count=14 
| eval zone = "A" 
| fields - _time 
| append
    [| makeresults | eval DateHour="2018-04-10" 
| eval event_count=14 
| eval zone = "B" | fields - _time ]
| append
    [| makeresults | eval DateHour="2018-04-11" 
| eval event_count=18 
| eval zone = "A" | fields - _time ]
| append
    [| makeresults | eval DateHour="2018-04-11" 
| eval event_count=18
| eval zone = "B" | fields - _time ] 

| chart values(event_count) over DateHour by zone