Splunk Search

How to Transpose table and group by values of other column?

yifatcy
Path Finder

Hi,

Say I have this table:

Name Date Flows
a 2022-06-13 23:01:26 200
a 2022-06-13 10:01:26 301
b 2022-06-13 23:01:26 504
b 2022-06-13 10:01:26 454

 

I'd like to create a table that's using the values of "Date" column as a new columns, and grouping all the identical "Name" values into one line as follows (where the values are "Flows"):

Name 2022-06-13 23:01:26 2022-06-13 10:01:26
a 200 301
b 504 454

 

I tried several approaches but failed. Could you assist?

Labels (6)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @yifatcy,

you should try the chart command (https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Chart) having something like the following:

index=your_index
| chart values(Flow) AS Flow OVER Name BY Date

 Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @yifatcy,

you should try the chart command (https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Chart) having something like the following:

index=your_index
| chart values(Flow) AS Flow OVER Name BY Date

 Ciao.

Giuseppe

yifatcy
Path Finder

Working! thanks

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...