Dashboards & Visualizations

How to format results in Splunk to columns instead of rows

pfurlanetto89
New Member

Hi there,

I am attempting to chart averages and means for field 'dur' and output these statistics in a column by 'activity'. However, my results keep showing up in the first row only with null values in the other rows.

This is the search I am using:

index="main" earliest="$timerange$" (activity="-call" OR activity="-proxy") | join Correlation_ID[search index="main" desc="$action_value$-*"]| stats count AS "Execution Count #" BY activity | rename activity AS "Individual Service" | eval corID=Correlation_ID

| appendcols[search index="main" activity="-call" earliest="$timerange$" | eval callDur=dur | join Correlation_ID[search index="main" activity="-proxy" | eval proxyDur=dur]
| join Correlation_ID[search index="main" desc="$action_value$-*"] | where isnotnull(callDur) | where isnotnull(proxyDur) | eval diffDur=proxyDur-callDur
| chart avg(callDur) AS "Average Call Time(ms)", avg(diffDur) AS "Average Proxy Time(ms)" BY activity ] | fillnull value=N/A

| appendcols[search index="main" activity="-proxy" earliest="$timerange$" | eval proxyDur=dur | join Correlation_ID[search index="main" activity="-call" | eval callDur=dur]
| join Correlation_ID[search index="main" desc="$action_value$-*"] | where isnotnull(proxyDur)
| where isnotnull(callDur) | eval diffDur=proxyDur-callDur
| chart mean(callDur) AS "Mean Call Time(ms)", mean(diffDur) AS "Mean Proxy Time(ms)" BY activity ] | fillnull value=N/A

| appendcols[search index="main" (activity="-call" OR activity="-proxy") earliest="$timerange$" | join Correlation_ID[search index="main" desc="$action_value$-*"] | chart eval(strftime(max(_time), "%Y-%m-%dT%H:%M:%S%:z" )) AS "Last Call (Date/time)" BY activity]
| fields "Individual Service" "Execution Count #" "Average Call Time(ms)" "Mean Call Time(ms)" "Average Proxy Time(ms)" "Mean Proxy Time(ms)" "Last Call (Date/time)"

Any help would be appreciated. Thank you so much!

Tags (1)
0 Karma

gfuente
Motivator

Yes

At the end, but I think that there is a limit of 10 columns to switch to files

Check if that's enough for your report

gfuente
Motivator

Hello,

Have you tried the transpose command?

It should do the trick

ARothman
Path Finder

At the end, yes.

[search query] | transpose

If you want to limit the number of rows (default is 5), you can add an integer after transpose.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transpose

0 Karma

pfurlanetto89
New Member

Hi gfuente,
Where would I transpose in my search query? At the end?

Thanks

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...