Splunk Search

How to filters results and convert rows to columns?

Splunk_321
Path Finder

I have a splunk query to get execution time of methods shown below

 

basesearch 
| where like(method,"A") OR like(method,"B")
| table method,time

 

 This will show execution time of method A and method B present in the same flow for multiple calls.

Results are something like below

 

method    time
A          110
B           95
A          120
A          110
B          101
A          110
B           95
A          125
A          115
B           80
B           85
B           90

 

I want to filter results such that execution time of A>=110 and corresponding execution time of B 

something like below

 

A         B
110       85
120      101
110       95
125      100
115       95

 

 

Labels (1)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| where (method=="A" AND time >= 110) OR method=="B"
| eval row=1
| chart list(time) as time by row method
| fields - row

 

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...