Splunk Search

Columns into Rows

ulikabbq
Path Finder

I am trying to turn my columns into rows and I have not had any luck with the xyseries command.

Here is my search:

index=loadtest source="*\\log\\home*" rps  data="*" | stats avg(data) AS "Home" | join type=outer [search index=loadtest source="*log\\view*" rps  | stats avg(data) AS "View"]  | join type=outer [search index=loadtest source="*log\\offer*" rps | stats avg(data) AS "Offer"]

so in the results I get

Home  View  Offer
58     55   55

And I want to get

Home 58
View 55
Offer 55
Tags (2)
1 Solution

somesoni2
Revered Legend

Alternative (using existing query)

index=loadtest source="*\\log\\home*" rps  data="*" | stats avg(data) AS "Home" | join type=outer [search index=loadtest source="*log\\view*" rps  | stats avg(data) AS "View"]  | join type=outer [search index=loadtest source="*log\\offer*" rps | stats avg(data) AS "Offer"] | eval id=1 | untable id Metric Value | fields - id

View solution in original post

somesoni2
Revered Legend

Alternative (using existing query)

index=loadtest source="*\\log\\home*" rps  data="*" | stats avg(data) AS "Home" | join type=outer [search index=loadtest source="*log\\view*" rps  | stats avg(data) AS "View"]  | join type=outer [search index=loadtest source="*log\\offer*" rps | stats avg(data) AS "Offer"] | eval id=1 | untable id Metric Value | fields - id

martin_mueller
SplunkTrust
SplunkTrust

Try this:

index=loadtest (source="*\\log\\home*" OR source="*\\log\\view*" OR source="*\\log\\offer*") rps data=* | eval category = case(match(source, "\\log\\home"), "Home", match(source, "\\log\\view"), "View", match(source, "\\log\\offer"), "Offer", 1=1, "Unknown") | stats avg(data) by category

martin_mueller
SplunkTrust
SplunkTrust

Right. Add backslashes until that goes away... probably needs four each, two get eaten by the string and one by the regex, leaving one to actually match the path separator.

That's what I get for not testing things 😛

ulikabbq
Path Finder

I got this
"Error in 'eval' command: Regex: PCRE does not support \L, \l, \N{name}, \U, or \u"

Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...