topic Re: How to convert values in a table column to column headers? in Splunk Search

How to convert values in a table column to column headers?

trunghung — Thu, 25 Feb 2016 19:04:17 GMT

I have a stats table like this

Header1......Error....Count
0-24hr..........1a..........1
0-24hr..........2a..........2
0-24hr..........3a..........3
24-48hr........1a..........4
24-48hr........2a..........5
24-48hr........3a..........6

and I'd like to transform it into a table like this and I'd like to sort it by one of the columns (for example 0-24hr column)

Error 0-24hr 24-48hr
1a..........1..........4
2a..........2..........5
3a..........3..........6

How would I do that? thank you very much

Re: How to convert values in a table column to column headers?

martin_mueller — Thu, 25 Feb 2016 19:23:17 GMT

Append this to your search:

... | xyseries Error Header1 Count

Re: How to convert values in a table column to column headers?

trunghung — Thu, 25 Feb 2016 19:43:37 GMT

Hi Martin,

that works. how do I sort the table by the 0-24hr column? thanks

Re: How to convert values in a table column to column headers?

martin_mueller — Thu, 25 Feb 2016 19:57:53 GMT

Something like this:

... | sort "0-24hr"

Make sure to get the column name correct, including case sensitivity.