Splunk Enterprise

Help with reformatting Splunk Search

Vani_26
Path Finder

Query:
|tstats avg(PREFIX(prtime)) as avg(prtime) where index=xdf  source=sdsf TERM(pght=eff) OR TERM(pght=dfrg) OR TERM(pght=iojb) by PREFIX(pght=)  _time span=1m

|rename pght= as Pght

this query is working fine and getting the results in below format:
Pght               _time                                         avg(prtime)

eff                 2022-09-07 13:00:00               40.667889889

dfrg             2022-09-07 13:01:00                75.678

iojb              2022-09-07 13:02:00               54.765423

 

but i want the results  in below format

_time                                               eff                                    dfrg                         iojb               

2022-09-07 13:00:00             40.667889889           75.678                  80.87656

2022-09-07 13:01:00            34.879                           64.897                    66.8765

2022-09-07 13:02:00           67.989                             89.09876             67.985

 

please let me know how to do this.

Labels (1)
Tags (1)
0 Karma

diogofgm
SplunkTrust
SplunkTrust

Just add a timechart command

| timechart values("avg(prtime)") by Pght
------------
Hope I was able to help you. If so, some karma would be appreciated.

Vani_26
Path Finder

@diogofgm , Thank you, it worked as expected.

i have one more the same, can u please help on this as well.

Query:
|tstats count where index=dfg source=htghy TERM(group=bxnbxnx) TERM(group=ghgjhb) by PREFIX(pstatus=) _time

|rename pstatus= as Pstatus

Pstatus              _time                   count

fail                     2022-09-01      89

fail                     2022-09-02     56

fail                     2022-09-03    123

pass                  2022-09-04    67

pass                  2022-09-05  78

pass                  2022-09-06   678

pass                  2022-09-07 1414

but i want in the below format:

_time                     pass                fail

2022-09-01        34                   16

2022-09-02        44                   33

2022-09-03        80                   20

2022-09-04        56                   22

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Same logic as the previous one

|timechart values(count) by Pstatus
------------
Hope I was able to help you. If so, some karma would be appreciated.
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...