Splunk Search

Expand column in to rows

teewenjie22
Engager

How to Convert 

_time             ColumnA                  ColumnB 
timeA             10                                20

into 

_time             Fields           Value
TimeA            ColumnA    10
TimeA            ColumnB    20

Labels (2)
0 Karma
1 Solution

tread_splunk
Splunk Employee
Splunk Employee
index=_internal 
| timechart count span=1h by sourcetype limit=5 useother=f partial=f 
| untable _time sourcetype count

The first 2 lines are to create some data.  You want the untable command in line 3.  Super useful!  (Coupled with xyseries to do the reverse).

View solution in original post

0 Karma

tread_splunk
Splunk Employee
Splunk Employee
index=_internal 
| timechart count span=1h by sourcetype limit=5 useother=f partial=f 
| untable _time sourcetype count

The first 2 lines are to create some data.  You want the untable command in line 3.  Super useful!  (Coupled with xyseries to do the reverse).

0 Karma

teewenjie22
Engager

Thanks you So much

Tags (1)
0 Karma

tread_splunk
Splunk Employee
Splunk Employee
index=_internal 
| timechart count span=1h by sourcetype limit=5 useother=f partial=f 
| untable _time fields value

This might make things clearer.  You can use any value you like where I've used _time, fields & value for the new column headings / field names.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...