transpose with a group by

[mschellhouse]

my data is currently setup as follows:

Group / Flag / Count
G1 / No / 5
G1 / Yes / 10
G1 / Total / 15
G2 / No / 7
G2 / Yes / 19
G1 / Total / 26
...

I am trying to "transpose" the data to this:
Group / Yes / No / Total
G1 / 5 / 10 / 15
G2 / 7 / 19 / 26
...

[jluo_splunk · Accepted solution]

So it sounds like you have something like this..

| stats count by group, flag
| appendpipe [stats sum(count) by group]

Instead, try this..

| chart count by group, flag
| addtotals row=t col=f

[jluo_splunk]

Can you post the search string you have to get your current table of data?

[mschellhouse]

Happy to answer questions about it but can't post the actual query. Doing a stats command by Group and Flag to get the count. To get the Total, I am using appendpipe.