Reformat table so values become Column headings

DanielFordWA — Tue, 29 Sep 2020 08:26:13 GMT

I have a search that ends with

| stats sum(count) AS Hits by _time GUID cs_uri_stem

Which results in a table

I would like to reformat the table as follows, but have had some difficulty.

Any help much appreciated!

Re: Reformat table so values become Column headings

vasanthmss — Fri, 15 Jan 2016 12:59:42 GMT

Hi DanielFordWA,

Try the below search,

... | stats sum(count) AS Hits by _time GUID cs_uri_stem | eval time=strftime(_time,"%+") | eval temp=time+"##"+GUID| table temp cs_uri_stem Hits | xyseries temp, cs_uri_stem Hits | fillnull | rex field=temp "(?<time>.*)##(?<GUID>.*)" | fields - temp | table time, GUID *

I have combined _time and GUID by "##" named as temp field, used xyseries to format the results as you expect. later extract the time and GUID from temp field.

Hope this will solve your problem.

Thanks,
V

topic Re: Reformat table so values become Column headings in Splunk Search

Reformat table so values become Column headings

Re: Reformat table so values become Column headings