Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Group results by rows and columns
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I need some help grouping and transposing some data. The search below gives me the data but now I want to group it and transpose one of the fields with it's data.
....
| stats count by Stage, Model,Region
| table Region,Model,Stage,count
| sort Region,Model,Stage
Region | Model | Stage | count
East | Blue | Phase1 | 5
East | Blue | Phase2 | 3
East | Red | Phase1 | 2
East | Red | Phase2 | 7
West | Blue | Phase1 | 6
West | Blue | Phase2 | 9
West | Red | Phase1 | 7
West | Red | Phase2 | 8
I want it to look like
Region | Model | Phase1 | Phase2
East | Blue | 5 | 3
........| Red | 2 | 7
West | Blue | 6 |9
........ | Red | 7 | 8
Sorry for my table formatting as I was sure how to do it nicely.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
something like this should help if added to the end:
...|eval{Stage}='count'|fields - Stage count|stats values(*) as * by Region Model
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
something like this should help if added to the end:
...|eval{Stage}='count'|fields - Stage count|stats values(*) as * by Region Model
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, that did the trick and saved me a bunch of time. I will add this to my toolbox of SPL.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just add this to the bottom:
| stats list(*) AS * BY Region
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the suggestion, while this produced the results it did not transpose the columns.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Index This | What travels the world but is also stuck in place?
Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data
Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...
