topic Re: how to have a timechart table group by columns in Splunk Search

how to have a timechart table group by columns

muthvin — Fri, 18 Mar 2016 04:29:36 GMT

Hi,

Please help me in creating a table with timechart grouped by columns:
_time Products Service

ProductA ProductB ProductC ServiceD ServiceE ServiceF
xxxx assaaa assaaa assaaa assaaa assaaa assaaa
xxxx assaaa assaaa assaaa assaaa assaaa assaaa
xxxx assaaa assaaa assaaa assaaa assaaa assaaa
xxxx assaaa assaaa assaaa assaaa assaaa assaaa
xxxx assaaa assaaa assaaa assaaa assaaa assaaa
xxxx assaaa assaaa assaaa assaaa assaaa assaaa

Re: how to have a timechart table group by columns

nawneel — Fri, 18 Mar 2016 06:19:01 GMT

Can you be please more specific with question ? is this your sample set of data ??

Re: how to have a timechart table group by columns

muthvin — Fri, 18 Mar 2016 06:25:40 GMT

Yes its just a sample data...

_time Products Services

ProductA Product B Product C ServiceA Service B Service C

Re: how to have a timechart table group by columns

debanjankundu — Fri, 18 Mar 2016 07:20:32 GMT

Can you please elaborate your quary to understand your question clearly

Re: how to have a timechart table group by columns

muthvin — Fri, 18 Mar 2016 08:03:33 GMT

I want a query to create a table with time stamp as column A
Products as column B and Services as Column C....then ColumnB (Products) should have 3 sub-column product A, B, c resp...like we use to have in Excel.

Re: how to have a timechart table group by columns

woodcock — Mon, 21 Mar 2016 03:09:10 GMT

Very generally, like this:

... | timechart span=1d dc(*) values(*)

You can then trim back to use just the dc or values pieces that you need (I am not sure if you are counting or listing). Change 1d to whatever you need (this is 1 day).