Dashboards & Visualizations

How to transpose 2nd column

james_n
Path Finder

I have query as shown below,

|stats count by stn stn_status

result:

stn stn_state count
stn_1 completed 20
stn_1 In progress 2
stn_1 failed 8
stn_2 completed 30
stn_3 completed 10
stn_3 failed 10

expected results:

Stn completed In progress failed

stn_1 20 2 8
stn_2 30
stn_3 10 10

Help me on this, Thanks in Advance.

Labels (1)
Tags (1)
0 Karma
1 Solution

rmmiller
Contributor

Replace your stats command with this:

| chart count over stn by stn_state

Note: I couldn't tell whether the correct field name is "stn_state" or "stn_status" since you use both in your question. Use the correct field name in this chart command, and you should get the results you want.

Hope that helps!
rmmiller

View solution in original post

woodcock
Esteemed Legend

Simply change stats to chart; no other changes are necessary.

0 Karma

rmmiller
Contributor

Replace your stats command with this:

| chart count over stn by stn_state

Note: I couldn't tell whether the correct field name is "stn_state" or "stn_status" since you use both in your question. Use the correct field name in this chart command, and you should get the results you want.

Hope that helps!
rmmiller

james_n
Path Finder

It Works, Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...