Dashboards & Visualizations

How to transpose 2nd column

james_n
Path Finder

I have query as shown below,

|stats count by stn stn_status

result:

stn stn_state count
stn_1 completed 20
stn_1 In progress 2
stn_1 failed 8
stn_2 completed 30
stn_3 completed 10
stn_3 failed 10

expected results:

Stn completed In progress failed

stn_1 20 2 8
stn_2 30
stn_3 10 10

Help me on this, Thanks in Advance.

Labels (1)
Tags (1)
0 Karma
1 Solution

rmmiller
Contributor

Replace your stats command with this:

| chart count over stn by stn_state

Note: I couldn't tell whether the correct field name is "stn_state" or "stn_status" since you use both in your question. Use the correct field name in this chart command, and you should get the results you want.

Hope that helps!
rmmiller

View solution in original post

woodcock
Esteemed Legend

Simply change stats to chart; no other changes are necessary.

0 Karma

rmmiller
Contributor

Replace your stats command with this:

| chart count over stn by stn_state

Note: I couldn't tell whether the correct field name is "stn_state" or "stn_status" since you use both in your question. Use the correct field name in this chart command, and you should get the results you want.

Hope that helps!
rmmiller

james_n
Path Finder

It Works, Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...