Splunk Search

How to reformat my table to make some rows into columns?

Engager

I have a table that looks like the following:

Endpoint ------- Application -------- Count
A ------------------ app1 ------------------ 1
A ------------------ app2 ------------------ 5
A ------------------ app3 ------------------ 10
B ------------------ app1 ------------------ 15
B ------------------ app2 ------------------ 20

I would like to transform this into a table like this:

Endpoint -------- app1 -------- app2 -------- app3
A ------------------ 1 --------------- 5 ------------ 10
B ------------------ 15 ------------- 20

Is this possible?

Tags (5)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Replace whatever is at the end of your search with this:

| contingency Endpoint Application

Bam!

View solution in original post

SplunkTrust
SplunkTrust

Replace whatever is at the end of your search with this:

| contingency Endpoint Application

Bam!

View solution in original post

Engager

This worked perfectly! Thanks!

0 Karma