How to transform a table?

[Edwin1471]

Hi,

How can I transform a table, so that the result would look something like this

Edwin1471_0-1661347469987.png

[gcusello]

Hi @Edwin1471,

can you share the search you used to have those data?

Anyway, you could use the transpose command (https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Transpose).

putting attention to the options.

Ciao.

Giuseppe

[ITWhisperer · Accepted solution]

| transpose 0 header_field=Process column_name=Process

[Edwin1471]

To follow up,

How can I sort a table by column values, instead of rows after transposing it ?

[ITWhisperer]

I am not sure I understand what you are trying to do - the sort command will sort the events (rows) by values in the fields (columns) - can you give an example of what you are trying to achieve?