https://community.splunk.com/t5/Splunk-Search/Transpose-and-Group-By/m-p/427647#M122436 <P>@SudeepDell, please accept the answer to mark this question as answered!</P> Sun, 08 Jul 2018 13:31:11 GMT niketn 2018-07-08T13:31:11Z https://community.splunk.com/t5/Splunk-Search/Transpose-and-Group-By/m-p/427644#M122433 <P>I am currently trying to format the amount of memory used by each node during a given time in a way that I could create an area graph from the results. Right now I have these three columns:</P> <PRE><CODE>index=main sourcetype=source | table _time memory node_name </CODE></PRE> <P>But I want the columns to be _time, node_name1, node_name2, ...<BR /> and the rows to contain the time and the related memory usage that goes along with the node_name.</P> <H2>How can I group the rows by time and separate the memory data for each of the nodes?</H2> <P>Results should look similar to this:</P> <P>time, node1, node2, node3, ...<BR /> 6/28, 10000, 20000, 16000, ...<BR /> 6/29, 15000, 24000, 12500, ...</P> Tue, 29 Sep 2020 20:20:25 GMT https://community.splunk.com/t5/Splunk-Search/Transpose-and-Group-By/m-p/427644#M122433 SudeepDell 2020-09-29T20:20:25Z https://community.splunk.com/t5/Splunk-Search/Transpose-and-Group-By/m-p/427645#M122434 <P>@SudeepDell you can try the following.</P> <PRE><CODE> index=main sourcetype=source | timechart span=1d max(memory) as Memory by node_name </CODE></PRE> Fri, 06 Jul 2018 10:51:10 GMT https://community.splunk.com/t5/Splunk-Search/Transpose-and-Group-By/m-p/427645#M122434 niketn 2018-07-06T10:51:10Z https://community.splunk.com/t5/Splunk-Search/Transpose-and-Group-By/m-p/427646#M122435 <P>that worked, thanks!</P> Fri, 06 Jul 2018 16:37:55 GMT https://community.splunk.com/t5/Splunk-Search/Transpose-and-Group-By/m-p/427646#M122435 SudeepDell 2018-07-06T16:37:55Z https://community.splunk.com/t5/Splunk-Search/Transpose-and-Group-By/m-p/427647#M122436 <P>@SudeepDell, please accept the answer to mark this question as answered!</P> Sun, 08 Jul 2018 13:31:11 GMT https://community.splunk.com/t5/Splunk-Search/Transpose-and-Group-By/m-p/427647#M122436 niketn 2018-07-08T13:31:11Z