https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-by-id/m-p/542177#M153576 <LI-CODE lang="markup">| makeresults | eval _raw="id time 1 2021-03-03 13:52:53.158 1 2021-03-03 13:52:53.001 1 2021-03-03 13:52:52.987 2 2021-03-03 11:59:50.950 2 2021-03-03 11:59:50.655 2 2021-03-03 11:59:50.631" | multikv forceheader=1 | fields - _* linecount | streamstats count as timecount by id | eval timecount="time".timecount | xyseries id timecount time</LI-CODE> Wed, 03 Mar 2021 14:40:10 GMT ITWhisperer 2021-03-03T14:40:10Z https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-by-id/m-p/542173#M153573 <P>Hi All,</P><P>I have a table similar to the following</P><TABLE width="260"><TBODY><TR><TD width="44">id</TD><TD width="154">time</TD></TR><TR><TD>1</TD><TD>2021-03-03 13:52:53.158</TD></TR><TR><TD>1</TD><TD>2021-03-03 13:52:53.001</TD></TR><TR><TD>1</TD><TD>2021-03-03 13:52:52.987</TD></TR><TR><TD width="44">2</TD><TD width="154">2021-03-03 11:59:50.950</TD></TR><TR><TD width="44">2</TD><TD width="154">2021-03-03 11:59:50.655</TD></TR><TR><TD width="44">2</TD><TD width="154">2021-03-03 11:59:50.631</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>the result I would like to achieve is</P><P>&nbsp;</P><TABLE width="650"><TBODY><TR><TD width="19">id</TD><TD width="154">time1</TD><TD width="154">time2</TD><TD width="154">time3</TD></TR><TR><TD>1</TD><TD>2021-03-03 13:52:53.158</TD><TD>2021-03-03 13:52:53.001</TD><TD>2021-03-03 13:52:52.987</TD></TR><TR><TD>2</TD><TD width="154">2021-03-03 11:59:50.950</TD><TD width="154">2021-03-03 11:59:50.655</TD><TD width="154">2021-03-03 11:59:50.631</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>it's possible?&nbsp;Thank you for any help</P><P>Simone</P> Wed, 03 Mar 2021 14:24:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-by-id/m-p/542173#M153573 simo 2021-03-03T14:24:17Z https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-by-id/m-p/542177#M153576 <LI-CODE lang="markup">| makeresults | eval _raw="id time 1 2021-03-03 13:52:53.158 1 2021-03-03 13:52:53.001 1 2021-03-03 13:52:52.987 2 2021-03-03 11:59:50.950 2 2021-03-03 11:59:50.655 2 2021-03-03 11:59:50.631" | multikv forceheader=1 | fields - _* linecount | streamstats count as timecount by id | eval timecount="time".timecount | xyseries id timecount time</LI-CODE> Wed, 03 Mar 2021 14:40:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-by-id/m-p/542177#M153576 ITWhisperer 2021-03-03T14:40:10Z https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-by-id/m-p/542180#M153578 <P><SPAN>Thank you <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span>&nbsp;I managed to solve</SPAN></P> Wed, 03 Mar 2021 14:52:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-transpose-a-table-by-id/m-p/542180#M153578 simo 2021-03-03T14:52:30Z