Expand column in to rows

[teewenjie22]

How to Convert 

_time             ColumnA                  ColumnB 
timeA             10                                20

into 

_time             Fields           Value
TimeA            ColumnA    10
TimeA            ColumnB    20

[tread_splunk · Accepted solution]

index=_internal 
| timechart count span=1h by sourcetype limit=5 useother=f partial=f 
| untable _time sourcetype count

The first 2 lines are to create some data.  You want the untable command in line 3.  Super useful!  (Coupled with xyseries to do the reverse).

[teewenjie22]

Thanks you So much

[tread_splunk]

index=_internal 
| timechart count span=1h by sourcetype limit=5 useother=f partial=f 
| untable _time fields value

This might make things clearer.  You can use any value you like where I've used _time, fields & value for the new column headings / field names.