Columns into Rows

[ulikabbq]

I am trying to turn my columns into rows and I have not had any luck with the xyseries command.

Here is my search:

index=loadtest source="*\\log\\home*" rps  data="*" | stats avg(data) AS "Home" | join type=outer [search index=loadtest source="*log\\view*" rps  | stats avg(data) AS "View"]  | join type=outer [search index=loadtest source="*log\\offer*" rps | stats avg(data) AS "Offer"]

so in the results I get

Home  View  Offer
58     55   55

And I want to get

Home 58
View 55
Offer 55

[somesoni2 · Accepted solution]

Alternative (using existing query)

index=loadtest source="*\\log\\home*" rps  data="*" | stats avg(data) AS "Home" | join type=outer [search index=loadtest source="*log\\view*" rps  | stats avg(data) AS "View"]  | join type=outer [search index=loadtest source="*log\\offer*" rps | stats avg(data) AS "Offer"] | eval id=1 | untable id Metric Value | fields - id

[martin_mueller]

Try this:

index=loadtest (source="*\\log\\home*" OR source="*\\log\\view*" OR source="*\\log\\offer*") rps data=* | eval category = case(match(source, "\\log\\home"), "Home", match(source, "\\log\\view"), "View", match(source, "\\log\\offer"), "Offer", 1=1, "Unknown") | stats avg(data) by category

[martin_mueller]

Right. Add backslashes until that goes away... probably needs four each, two get eaten by the string and one by the regex, leaving one to actually match the path separator.

That's what I get for not testing things 😛

[ulikabbq]

I got this
"Error in 'eval' command: Regex: PCRE does not support \L, \l, \N{name}, \U, or \u"