Splunk Search

How to reformat my table to make some rows into columns?

trutgers
Engager

I have a table that looks like the following:

Endpoint ------- Application -------- Count
A ------------------ app1 ------------------ 1
A ------------------ app2 ------------------ 5
A ------------------ app3 ------------------ 10
B ------------------ app1 ------------------ 15
B ------------------ app2 ------------------ 20

I would like to transform this into a table like this:

Endpoint -------- app1 -------- app2 -------- app3
A ------------------ 1 --------------- 5 ------------ 10
B ------------------ 15 ------------- 20

Is this possible?

Tags (5)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Replace whatever is at the end of your search with this:

| contingency Endpoint Application

Bam!

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

Replace whatever is at the end of your search with this:

| contingency Endpoint Application

Bam!

trutgers
Engager

This worked perfectly! Thanks!

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...