Splunk Search

How to write a search to convert columns to rows?

Engager

I need to convert the following source data as a specified output.

Source Data

 API    SUCCESS    FAIL    POLICY    TOTAL
 x        2         3        4         9

Need a search to convert as following

 API    Measure    Count
  x     SUCCESS      2
  x      FAIL        3
  X     POLICY       4
  x      Total      9

Any inputs?

1 Solution

SplunkTrust
SplunkTrust

I would just do it this way:

your search here
| untable API Measure Count

I replicated your use case with the following CSV:

API, SUCCESS, FAIL, POLICY, TOTAL
x, 2, 3, 4, 9

And tested it with the following query:

| inputcsv mycsv.csv
| untable API Measure Count

And the output is: see attached image.

alt text

View solution in original post

SplunkTrust
SplunkTrust

I would just do it this way:

your search here
| untable API Measure Count

I replicated your use case with the following CSV:

API, SUCCESS, FAIL, POLICY, TOTAL
x, 2, 3, 4, 9

And tested it with the following query:

| inputcsv mycsv.csv
| untable API Measure Count

And the output is: see attached image.

alt text

View solution in original post

Communicator

This works @javiergn, thnxs

0 Karma

Splunk Employee
Splunk Employee

You can work an iteration of stats, and then use the transpose command to work with this and format it how you want..

See: Transpose : http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Transpose

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!