Dashboards & Visualizations

How to transpose 2nd column

james_n
Path Finder

I have query as shown below,

|stats count by stn stn_status

result:

stn stn_state count
stn_1 completed 20
stn_1 In progress 2
stn_1 failed 8
stn_2 completed 30
stn_3 completed 10
stn_3 failed 10

expected results:

Stn completed In progress failed

stn_1 20 2 8
stn_2 30
stn_3 10 10

Help me on this, Thanks in Advance.

Labels (1)
Tags (1)
0 Karma
1 Solution

rmmiller
Contributor

Replace your stats command with this:

| chart count over stn by stn_state

Note: I couldn't tell whether the correct field name is "stn_state" or "stn_status" since you use both in your question. Use the correct field name in this chart command, and you should get the results you want.

Hope that helps!
rmmiller

View solution in original post

woodcock
Esteemed Legend

Simply change stats to chart; no other changes are necessary.

0 Karma

rmmiller
Contributor

Replace your stats command with this:

| chart count over stn by stn_state

Note: I couldn't tell whether the correct field name is "stn_state" or "stn_status" since you use both in your question. Use the correct field name in this chart command, and you should get the results you want.

Hope that helps!
rmmiller

james_n
Path Finder

It Works, Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...