Splunk Search

Columns into Rows

ulikabbq
Path Finder

I am trying to turn my columns into rows and I have not had any luck with the xyseries command.

Here is my search:

index=loadtest source="*\\log\\home*" rps  data="*" | stats avg(data) AS "Home" | join type=outer [search index=loadtest source="*log\\view*" rps  | stats avg(data) AS "View"]  | join type=outer [search index=loadtest source="*log\\offer*" rps | stats avg(data) AS "Offer"]

so in the results I get

Home  View  Offer
58     55   55

And I want to get

Home 58
View 55
Offer 55
Tags (2)
1 Solution

somesoni2
Revered Legend

Alternative (using existing query)

index=loadtest source="*\\log\\home*" rps  data="*" | stats avg(data) AS "Home" | join type=outer [search index=loadtest source="*log\\view*" rps  | stats avg(data) AS "View"]  | join type=outer [search index=loadtest source="*log\\offer*" rps | stats avg(data) AS "Offer"] | eval id=1 | untable id Metric Value | fields - id

View solution in original post

somesoni2
Revered Legend

Alternative (using existing query)

index=loadtest source="*\\log\\home*" rps  data="*" | stats avg(data) AS "Home" | join type=outer [search index=loadtest source="*log\\view*" rps  | stats avg(data) AS "View"]  | join type=outer [search index=loadtest source="*log\\offer*" rps | stats avg(data) AS "Offer"] | eval id=1 | untable id Metric Value | fields - id

martin_mueller
SplunkTrust
SplunkTrust

Try this:

index=loadtest (source="*\\log\\home*" OR source="*\\log\\view*" OR source="*\\log\\offer*") rps data=* | eval category = case(match(source, "\\log\\home"), "Home", match(source, "\\log\\view"), "View", match(source, "\\log\\offer"), "Offer", 1=1, "Unknown") | stats avg(data) by category

martin_mueller
SplunkTrust
SplunkTrust

Right. Add backslashes until that goes away... probably needs four each, two get eaten by the string and one by the regex, leaving one to actually match the path separator.

That's what I get for not testing things 😛

ulikabbq
Path Finder

I got this
"Error in 'eval' command: Regex: PCRE does not support \L, \l, \N{name}, \U, or \u"

Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...