How to Convert
_time ColumnA ColumnB
timeA 10 20
into
_time Fields Value
TimeA ColumnA 10
TimeA ColumnB 20
index=_internal
| timechart count span=1h by sourcetype limit=5 useother=f partial=f
| untable _time sourcetype count
The first 2 lines are to create some data. You want the untable command in line 3. Super useful! (Coupled with xyseries to do the reverse).
index=_internal
| timechart count span=1h by sourcetype limit=5 useother=f partial=f
| untable _time sourcetype count
The first 2 lines are to create some data. You want the untable command in line 3. Super useful! (Coupled with xyseries to do the reverse).
index=_internal
| timechart count span=1h by sourcetype limit=5 useother=f partial=f
| untable _time fields value
This might make things clearer. You can use any value you like where I've used _time, fields & value for the new column headings / field names.