Splunk Dev

perfmon counter as column for hosts issue

k_harini
Communicator

Hi,
I have data extracted from windows perfmon logs
Query I used
index=perfmon_cpu counter="% Idle time" OR counter="% User Time" OR counter="% Processor Time"|stats latest(Value) as "Percent" by host counter

Here I get all the hosts, with counter and %. I want all the counters to be column with Values as %for hosts. If I use transpose - hosts are also getting as columns. I don't want that. Any idea to retain hosts and changing counters and their values in columns. Counters are idle time, user time and processor time. Values are in %. Please help

Tags (1)
0 Karma
1 Solution

maciep
Champion

I think you might want chart instead of stats here.

chart latest(Value) as value over counter by host

or maybe over host by counter (can never remember)

And there is also xyseries ,which can make your stats results look the way you want as well.
https://answers.splunk.com/answers/93327/xyseries-vs-chart-over-by.html

View solution in original post

0 Karma

k_harini
Communicator

Thank you :slightly_smiling_face:

0 Karma

maciep
Champion

I think you might want chart instead of stats here.

chart latest(Value) as value over counter by host

or maybe over host by counter (can never remember)

And there is also xyseries ,which can make your stats results look the way you want as well.
https://answers.splunk.com/answers/93327/xyseries-vs-chart-over-by.html

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...