Splunk Search

How do I change the structure of the following table?

AKG1_old1
Builder

Hello,

My search query produce the table in below format.

_time                          Class                   Memory
2018-12-03 16:07:47             A                        19
2018-12-03 16:08:29             A                        18
2018-12-03 16:16:43             A                        20
2018-12-03 16:07:47             B                       111
2018-12-03 16:08:29             B                       120
2018-12-03 16:16:43             B                       105

I am looking to convert it in below format.

_time                            A               B   
2018-12-03 16:07:47             19              111
2018-12-03 16:08:29             18              120
2018-12-03 16:16:43             20              105

Search Query:

index=* sourcetype=jmap host=* | fields _time class bytes | eval MB= round(bytes/1000000,0) | stats values(MB) as Memory_MB  by _time,class | sort class | head 10 | fields _time class Memory_MB

Thanks

Tags (2)
0 Karma
1 Solution

AKG1_old1
Builder
index=* sourcetype=jmap host=* | fields _time class bytes | eval MB= round(bytes/1000000,0) | stats values(MB) as Memory_MB  by _time,class | sort class | head 10 | fields class Memory_MB | chart values(Memory_MB) as Memory by _time,class

View solution in original post

0 Karma

AKG1_old1
Builder
index=* sourcetype=jmap host=* | fields _time class bytes | eval MB= round(bytes/1000000,0) | stats values(MB) as Memory_MB  by _time,class | sort class | head 10 | fields class Memory_MB | chart values(Memory_MB) as Memory by _time,class
0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...