topic How to change host as row and time as column in Splunk Search

How to change host as row and time as column

Zodi_6 — Sat, 18 Nov 2023 09:10:30 GMT

Hi there, I have this query:

index=_internal source="*license_usage.log" | eval bytes=b | eval GB = round(bytes/1024/1024/1024,3) | timechart span=1d sum(GB) by h

This query shows results like this:

_time	host1	....
2023-11-10
2023-11-11
...

And I want results like this:

Host	2023-11-10	....
host1
host2
...

How I can do this?

Re: How to change host as row and time as column

yuanliu — Sat, 18 Nov 2023 03:41:24 GMT

Use chart.

Re: How to change host as row and time as column

gcusello — Sat, 18 Nov 2023 06:52:57 GMT

Hi @Zodi_6 ,

see the transpose command at https://docs.splunk.com/Documentation/Splunk/9.1.2/SearchReference/Transpose and, please, try:

index=_internal source="*license_usage.log" | eval bytes=b | eval GB = round(bytes/1024/1024/1024,3) | timechart span=1d sum(GB) by h | transpose 0 column_name=h header_field_time

Ciao.

Giuseppe