Splunk Dev

perfmon counter as column for hosts issue

k_harini
Communicator

Hi,
I have data extracted from windows perfmon logs
Query I used
index=perfmon_cpu counter="% Idle time" OR counter="% User Time" OR counter="% Processor Time"|stats latest(Value) as "Percent" by host counter

Here I get all the hosts, with counter and %. I want all the counters to be column with Values as %for hosts. If I use transpose - hosts are also getting as columns. I don't want that. Any idea to retain hosts and changing counters and their values in columns. Counters are idle time, user time and processor time. Values are in %. Please help

Tags (1)
0 Karma
1 Solution

maciep
Champion

I think you might want chart instead of stats here.

chart latest(Value) as value over counter by host

or maybe over host by counter (can never remember)

And there is also xyseries ,which can make your stats results look the way you want as well.
https://answers.splunk.com/answers/93327/xyseries-vs-chart-over-by.html

View solution in original post

0 Karma

k_harini
Communicator

Thank you 🙂

0 Karma

maciep
Champion

I think you might want chart instead of stats here.

chart latest(Value) as value over counter by host

or maybe over host by counter (can never remember)

And there is also xyseries ,which can make your stats results look the way you want as well.
https://answers.splunk.com/answers/93327/xyseries-vs-chart-over-by.html

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...