Splunk Search

Columns into Rows

ulikabbq
Path Finder

I am trying to turn my columns into rows and I have not had any luck with the xyseries command.

Here is my search:

index=loadtest source="*\\log\\home*" rps  data="*" | stats avg(data) AS "Home" | join type=outer [search index=loadtest source="*log\\view*" rps  | stats avg(data) AS "View"]  | join type=outer [search index=loadtest source="*log\\offer*" rps | stats avg(data) AS "Offer"]

so in the results I get

Home  View  Offer
58     55   55

And I want to get

Home 58
View 55
Offer 55
Tags (2)
1 Solution

somesoni2
Revered Legend

Alternative (using existing query)

index=loadtest source="*\\log\\home*" rps  data="*" | stats avg(data) AS "Home" | join type=outer [search index=loadtest source="*log\\view*" rps  | stats avg(data) AS "View"]  | join type=outer [search index=loadtest source="*log\\offer*" rps | stats avg(data) AS "Offer"] | eval id=1 | untable id Metric Value | fields - id

View solution in original post

somesoni2
Revered Legend

Alternative (using existing query)

index=loadtest source="*\\log\\home*" rps  data="*" | stats avg(data) AS "Home" | join type=outer [search index=loadtest source="*log\\view*" rps  | stats avg(data) AS "View"]  | join type=outer [search index=loadtest source="*log\\offer*" rps | stats avg(data) AS "Offer"] | eval id=1 | untable id Metric Value | fields - id

martin_mueller
SplunkTrust
SplunkTrust

Try this:

index=loadtest (source="*\\log\\home*" OR source="*\\log\\view*" OR source="*\\log\\offer*") rps data=* | eval category = case(match(source, "\\log\\home"), "Home", match(source, "\\log\\view"), "View", match(source, "\\log\\offer"), "Offer", 1=1, "Unknown") | stats avg(data) by category

martin_mueller
SplunkTrust
SplunkTrust

Right. Add backslashes until that goes away... probably needs four each, two get eaten by the string and one by the regex, leaving one to actually match the path separator.

That's what I get for not testing things 😛

ulikabbq
Path Finder

I got this
"Error in 'eval' command: Regex: PCRE does not support \L, \l, \N{name}, \U, or \u"

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...