https://community.splunk.com/t5/Splunk-Search/how-to-transpose-rows-into-multiple-columns-based-on-grouping/m-p/75141#M18985 <P>Hi,</P> <P>I have a query which fetches me the below result in a table:</P> <H2>Thread | Total_Run_Time</H2> <P>READER_1_1_1 303.971798</P> <P>READER_1_1_1 151.724136</P> <P>READER_1_2_1 303.97251</P> <P>READER_1_2_1 151.728481</P> <P>TRANSF_1_1_1 310.477318</P> <P>TRANSF_1_1_1 157.788452</P> <P>TRANSF_1_2_1 310.480424</P> <P>TRANSF_1_2_1 157.791372</P> <P>WRITER_1_*_1 310.985073</P> <P>WRITER_1_*_1 159.198983</P> <P><STRONG>I want all the distinct values(number is dynamic) under 'Thread' as columns with corresponding values from Total_Run_Time</STRONG></P> <P><STRONG>I need the result like this:</STRONG></P> <P>READER_1_1_1_Total_Run_Time | READER_1_2_1_Total_Run_Time | TRANSF_1_1_1_Total_Run_Time | TRANSF_1_2_1_Total_Run_Time | WRITER_1_*_1_Total_Run_Time</P> <P>303.971798 303.97251 310.477318 310.480424 310.985073</P> <P>151.724136 151.728481 157.788452 157.791372 159.198983</P> <HR /> <P><STRONG>Edit based on the suggestion:</STRONG></P> <HR /> <P>The query suggested by asimagu "| chart list(Total_Run_Time) over date_hour by Thread" gave the below result:</P> <P>date_hour READER_1_1_1 READER_1_2_1 TRANSF_1_1_1 TRANSF_\1_\2_1 WRITER_\1_*_\1</P> <HR /> <P>17 (303.971798 151.724136) (303.97251 151.728481) (310.477318 157.788452) (310.480424 157.791372) (310.985073 159.198983) </P> <P><STRONG>How to make a line chart of true values of these fields by columns (like READER_1_1_1 with 303.971798, 151.724136) as these are multivalue fields?</STRONG></P> <P>please suggest</P> Mon, 28 Sep 2020 14:10:17 GMT trkalva 2020-09-28T14:10:17Z https://community.splunk.com/t5/Splunk-Search/how-to-transpose-rows-into-multiple-columns-based-on-grouping/m-p/75141#M18985 <P>Hi,</P> <P>I have a query which fetches me the below result in a table:</P> <H2>Thread | Total_Run_Time</H2> <P>READER_1_1_1 303.971798</P> <P>READER_1_1_1 151.724136</P> <P>READER_1_2_1 303.97251</P> <P>READER_1_2_1 151.728481</P> <P>TRANSF_1_1_1 310.477318</P> <P>TRANSF_1_1_1 157.788452</P> <P>TRANSF_1_2_1 310.480424</P> <P>TRANSF_1_2_1 157.791372</P> <P>WRITER_1_*_1 310.985073</P> <P>WRITER_1_*_1 159.198983</P> <P><STRONG>I want all the distinct values(number is dynamic) under 'Thread' as columns with corresponding values from Total_Run_Time</STRONG></P> <P><STRONG>I need the result like this:</STRONG></P> <P>READER_1_1_1_Total_Run_Time | READER_1_2_1_Total_Run_Time | TRANSF_1_1_1_Total_Run_Time | TRANSF_1_2_1_Total_Run_Time | WRITER_1_*_1_Total_Run_Time</P> <P>303.971798 303.97251 310.477318 310.480424 310.985073</P> <P>151.724136 151.728481 157.788452 157.791372 159.198983</P> <HR /> <P><STRONG>Edit based on the suggestion:</STRONG></P> <HR /> <P>The query suggested by asimagu "| chart list(Total_Run_Time) over date_hour by Thread" gave the below result:</P> <P>date_hour READER_1_1_1 READER_1_2_1 TRANSF_1_1_1 TRANSF_\1_\2_1 WRITER_\1_*_\1</P> <HR /> <P>17 (303.971798 151.724136) (303.97251 151.728481) (310.477318 157.788452) (310.480424 157.791372) (310.985073 159.198983) </P> <P><STRONG>How to make a line chart of true values of these fields by columns (like READER_1_1_1 with 303.971798, 151.724136) as these are multivalue fields?</STRONG></P> <P>please suggest</P> Mon, 28 Sep 2020 14:10:17 GMT https://community.splunk.com/t5/Splunk-Search/how-to-transpose-rows-into-multiple-columns-based-on-grouping/m-p/75141#M18985 trkalva 2020-09-28T14:10:17Z https://community.splunk.com/t5/Splunk-Search/how-to-transpose-rows-into-multiple-columns-based-on-grouping/m-p/75142#M18986 <P>have a play with </P> <P>chart <YOUR_METRIC> over <YOUR_FIRST_FIELD> by <YOUR_SECOND_FIELD></YOUR_SECOND_FIELD></YOUR_FIRST_FIELD></YOUR_METRIC></P> <P>that should do the magic, I don't know what your search looks like but maybe play putting your field names in one or other position in the command I just gave you</P> Tue, 25 Jun 2013 21:42:12 GMT https://community.splunk.com/t5/Splunk-Search/how-to-transpose-rows-into-multiple-columns-based-on-grouping/m-p/75142#M18986 asimagu 2013-06-25T21:42:12Z