Splunk Search

Columns into Rows

ulikabbq
Path Finder

I am trying to turn my columns into rows and I have not had any luck with the xyseries command.

Here is my search:

index=loadtest source="*\\log\\home*" rps  data="*" | stats avg(data) AS "Home" | join type=outer [search index=loadtest source="*log\\view*" rps  | stats avg(data) AS "View"]  | join type=outer [search index=loadtest source="*log\\offer*" rps | stats avg(data) AS "Offer"]

so in the results I get

Home  View  Offer
58     55   55

And I want to get

Home 58
View 55
Offer 55
Tags (2)
1 Solution

somesoni2
Revered Legend

Alternative (using existing query)

index=loadtest source="*\\log\\home*" rps  data="*" | stats avg(data) AS "Home" | join type=outer [search index=loadtest source="*log\\view*" rps  | stats avg(data) AS "View"]  | join type=outer [search index=loadtest source="*log\\offer*" rps | stats avg(data) AS "Offer"] | eval id=1 | untable id Metric Value | fields - id

View solution in original post

somesoni2
Revered Legend

Alternative (using existing query)

index=loadtest source="*\\log\\home*" rps  data="*" | stats avg(data) AS "Home" | join type=outer [search index=loadtest source="*log\\view*" rps  | stats avg(data) AS "View"]  | join type=outer [search index=loadtest source="*log\\offer*" rps | stats avg(data) AS "Offer"] | eval id=1 | untable id Metric Value | fields - id

martin_mueller
SplunkTrust
SplunkTrust

Try this:

index=loadtest (source="*\\log\\home*" OR source="*\\log\\view*" OR source="*\\log\\offer*") rps data=* | eval category = case(match(source, "\\log\\home"), "Home", match(source, "\\log\\view"), "View", match(source, "\\log\\offer"), "Offer", 1=1, "Unknown") | stats avg(data) by category

martin_mueller
SplunkTrust
SplunkTrust

Right. Add backslashes until that goes away... probably needs four each, two get eaten by the string and one by the regex, leaving one to actually match the path separator.

That's what I get for not testing things 😛

ulikabbq
Path Finder

I got this
"Error in 'eval' command: Regex: PCRE does not support \L, \l, \N{name}, \U, or \u"

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...