How to view records/data horizontally by host?

[hartcl1]

Hey is it possible to view data/records from a file horizontally by host.

For example, I have a search string like this:

search "event1234" | table host, value1,value2, value3

The result looks like this:

hostname1, value1
hostname1, value2
hostname1, value3

What I want to see is:

hostname, value1, value2, value3    

I want the records to be grouped by hostname and the data to grow horizontally for each hostname.

Is this possible?

C

[somesoni2 · Accepted solution]

You would be able to use commands like "chart" OR "xyseries" to do this transformation, but usage will depend on your data and required format. Please provide some sample data for better suggestions.

something like this

 "event1234" | table host, value | chart count over host by value

"event1234" | table host, value | eval temp=1| xyseries hostname value temp

[jensonthottian]

Use transpose - http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/Transpose#Examples