reformating stats and eval output as columns and rows

rickl — Thu, 28 Mar 2013 03:04:11 GMT

I have the below search to output the values for response times for an application,

index="summary_application_responcetimes" | stats 
max(CorpWeb_ResponceTime) as CorpWeb_ResponceTime 
max(DPSCC_ResponceTime) as DPSCC_ResponceTime 
max(TotalUser_ResponceTime) as TotalUser_ResponceTime 
| eval CorpWeb_Status=if(CorpWeb_ResponceTime > 30, 1, 0) 
| eval DPSCC_Status=if(DPSCC_ResponceTime> 10, 1, 0) 
| eval TotalUser_Status=if(TotalUser_ResponceTime > 30, 1, 0)
| eval MyApp = if(DPSCC_Status + CorpWeb_Status >= 1, 1, 0)

----------
The output is a single row with multiple columns

CorpWeb_ResponceTime DPSCC_ResponceTime TotalUser_ResponceTime CorpWeb_Status DPSCC_Status TotalUser_Status MyApp
2.802000000      5.93600000         60.115000000           0              0            1                 1
----------

but what I want is two columns with the values in the rows.

            ResponceTime    Status
CorpWeb     2.802000000         0
DPSCC       5.936000000         0
TotalUser   60.115000000        1
MyApp                           1

I have tried subsearchs and appendcols as well as transpose, Im sure its relatively straight forward but I can get the commands/syntax correct

Re: reformating stats and eval output as columns and rows

jonuwz — Thu, 28 Mar 2013 09:12:09 GMT

untable is your friend

... | untable "" measure value
    | rex field=measure "(?<field>[^_]+)(?:_(?<metric>.*))?"
    | fillnull value="Status" metric
    | xyseries field metric value

Add the lines 1 by one to see what they do.

Re: reformating stats and eval output as columns and rows

rickl — Mon, 01 Apr 2013 09:01:02 GMT

perfect thanks.

topic Re: reformating stats and eval output as columns and rows in Splunk Search

reformating stats and eval output as columns and rows

Re: reformating stats and eval output as columns and rows

Re: reformating stats and eval output as columns and rows