Splunk Search

How to filters results and convert rows to columns?

Splunk_321
Path Finder

I have a splunk query to get execution time of methods shown below

 

basesearch 
| where like(method,"A") OR like(method,"B")
| table method,time

 

 This will show execution time of method A and method B present in the same flow for multiple calls.

Results are something like below

 

method    time
A          110
B           95
A          120
A          110
B          101
A          110
B           95
A          125
A          115
B           80
B           85
B           90

 

I want to filter results such that execution time of A>=110 and corresponding execution time of B 

something like below

 

A         B
110       85
120      101
110       95
125      100
115       95

 

 

Labels (1)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| where (method=="A" AND time >= 110) OR method=="B"
| eval row=1
| chart list(time) as time by row method
| fields - row

 

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...