Splunk Search

How to reformat my table to make some rows into columns?

trutgers
Engager

I have a table that looks like the following:

Endpoint ------- Application -------- Count
A ------------------ app1 ------------------ 1
A ------------------ app2 ------------------ 5
A ------------------ app3 ------------------ 10
B ------------------ app1 ------------------ 15
B ------------------ app2 ------------------ 20

I would like to transform this into a table like this:

Endpoint -------- app1 -------- app2 -------- app3
A ------------------ 1 --------------- 5 ------------ 10
B ------------------ 15 ------------- 20

Is this possible?

Tags (5)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Replace whatever is at the end of your search with this:

| contingency Endpoint Application

Bam!

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

Replace whatever is at the end of your search with this:

| contingency Endpoint Application

Bam!

trutgers
Engager

This worked perfectly! Thanks!

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...