Display data in a tabular format

[sajug]

I am looking for some help in getting the logs formatted in a tabular format

I have these in the logs getting printed every 5 minutes

07-06-19:00:40, eventtype=ping, rsptime=0.190, srvname=srv1, srvip=xxx.xxx.xxx.01
07-06-19:00:40, eventtype=ping, rsptime=0.201, srvname=srv2, srvip=xxx.xxx.xxx.02
07-06-19:00:40, eventtype=ping, rsptime=16.991, srvname=srv3, srvip=xxx.xxx.xxx.03
07-06-19:00:40, eventtype=ping, rsptime=17.000, srvname=srv4, srvip=xxx.xxx.xxx.04

07-06-19:05:40, eventtype=ping, rsptime=0.190, srvname=srv1, srvip=xxx.xxx.xxx.01
07-06-19:00:40, eventtype=ping, rsptime=0.201, srvname=srv2, srvip=xxx.xxx.xxx.02
07-06-19:05:40, eventtype=ping, rsptime=16.991, srvname=srv3, srvip=xxx.xxx.xxx.03
07-06-19:05:40, eventtype=ping, rsptime=17.000, srvname=srv4, srvip=xxx.xxx.xxx.04

I want the above data to presented in the below format

         srv1|srv2|srv3|srv4

07-06-19:00 0.190 | 0.201 | 0.201 | 16.991 | 17.000
07-06-19:05 0.190 | 0.201 | 0.201 | 16.991 | 17.000

First row/column heading is going to be the server name
Rows will print the rsptime

[sajug]

Actually your first query worked for me. Thank you Woodcock

[woodcock · Accepted solution]

You asked for this:

index=<You Should Always Specify An index> AND sourcetype=<And sourcetpye Too>
| table _time rsptime srvname
| xyseries _time srvname rsptime

But you probably need is something like this:

index=<You Should Always Specify An index> AND sourcetype=<And sourcetpye Too>
| timechart span=15m avg(rsptime) BY srvname