Splunk Search

How to Transpose table and group by values of other column?

yifatcy
Path Finder

Hi,

Say I have this table:

Name Date Flows
a 2022-06-13 23:01:26 200
a 2022-06-13 10:01:26 301
b 2022-06-13 23:01:26 504
b 2022-06-13 10:01:26 454

 

I'd like to create a table that's using the values of "Date" column as a new columns, and grouping all the identical "Name" values into one line as follows (where the values are "Flows"):

Name 2022-06-13 23:01:26 2022-06-13 10:01:26
a 200 301
b 504 454

 

I tried several approaches but failed. Could you assist?

0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @yifatcy,

you should try the chart command (https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Chart) having something like the following:

index=your_index
| chart values(Flow) AS Flow OVER Name BY Date

 Ciao.

Giuseppe

View solution in original post

gcusello
Esteemed Legend

Hi @yifatcy,

you should try the chart command (https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Chart) having something like the following:

index=your_index
| chart values(Flow) AS Flow OVER Name BY Date

 Ciao.

Giuseppe

yifatcy
Path Finder

Working! thanks

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...