topic Re: How do you display AVG, MIN, and MAX as row headers by Service? in Splunk Search

How do you display AVG, MIN, and MAX as row headers by Service?

cmcdole — Thu, 28 Mar 2019 15:59:54 GMT

I have several services that I need to calculate Avg/min/max for.

{basesearch} | stats avg(transTime) as "Avg", min(transTime) as "Min", max(transTime) as "Max", values(JBossService) as JBoss_Service by JBossService

I need the display to look something like this.

         Service1|Service2|Service3|Service4
Avg  ____###__|__###__|__##____|__##____
Min  ____###__|__###__|__##____|__##____
Max  ____###__|__###__|__##____|__##____

Please help!! Thanks 🙂

Re: How do you display AVG, MIN, and MAX as row headers by Service?

solarboyz1 — Thu, 28 Mar 2019 16:46:57 GMT

Try using the chart function:

You can specify which field is tracked on the x-axis of the chart. The x-axis variable is specified with a by field and is discretized if necessary. Charted fields are converted to numerical quantities if necessary.
(https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Chart)

... | chart avg(transTime) as "Avg", min(transTime) as "Min", max(transTime) as "Max", values(JBossService) as JBoss_Service by JBossService

Re: How do you display AVG, MIN, and MAX as row headers by Service?

niketn — Thu, 28 Mar 2019 18:46:12 GMT

@cmcdole try the following with transpose command with limit=0 to invert all rows as columns and columns as rows:

{basesearch} 
| stats avg(transTime) as "Avg", min(transTime) as "Min", max(transTime) as "Max" by JBossService
| transpose 0 header_field=JBossService column_name=JBossService

Following is a run anywhere search based on Splunk's _internal index:

index=_internal sourcetype=splunkd log_level!=INFO
| stats avg(date_second) as Avg min(date_second) as Min max(date_second) as Max by component
| transpose 0 header_field=component column_name=component

Re: How do you display AVG, MIN, and MAX as row headers by Service?

isachse — Thu, 28 Mar 2019 19:45:28 GMT

Have a look to the untable command. That might be a good solution.

Re: How do you display AVG, MIN, and MAX as row headers by Service?

cmcdole — Fri, 29 Mar 2019 13:35:30 GMT

This worked perfectly!! Thanks!