perfmon counter as column for hosts issue

[k_harini]

Hi,
I have data extracted from windows perfmon logs
Query I used
index=perfmon_cpu counter="% Idle time" OR counter="% User Time" OR counter="% Processor Time"|stats latest(Value) as "Percent" by host counter

Here I get all the hosts, with counter and %. I want all the counters to be column with Values as %for hosts. If I use transpose - hosts are also getting as columns. I don't want that. Any idea to retain hosts and changing counters and their values in columns. Counters are idle time, user time and processor time. Values are in %. Please help

[k_harini]

Thank you 🙂

[maciep · Accepted solution]

I think you might want chart instead of stats here.

chart latest(Value) as value over counter by host

or maybe over host by counter (can never remember)

And there is also xyseries ,which can make your stats results look the way you want as well.
https://answers.splunk.com/answers/93327/xyseries-vs-chart-over-by.html