Splunk Search

How to write a search to convert columns to rows?

kpkvarma
Engager

I need to convert the following source data as a specified output.

Source Data

 API    SUCCESS    FAIL    POLICY    TOTAL
 x        2         3        4         9

Need a search to convert as following

 API    Measure    Count
  x     SUCCESS      2
  x      FAIL        3
  X     POLICY       4
  x      Total      9

Any inputs?

1 Solution

javiergn
Super Champion

I would just do it this way:

your search here
| untable API Measure Count

I replicated your use case with the following CSV:

API, SUCCESS, FAIL, POLICY, TOTAL
x, 2, 3, 4, 9

And tested it with the following query:

| inputcsv mycsv.csv
| untable API Measure Count

And the output is: see attached image.

alt text

View solution in original post

javiergn
Super Champion

I would just do it this way:

your search here
| untable API Measure Count

I replicated your use case with the following CSV:

API, SUCCESS, FAIL, POLICY, TOTAL
x, 2, 3, 4, 9

And tested it with the following query:

| inputcsv mycsv.csv
| untable API Measure Count

And the output is: see attached image.

alt text

ashish9433
Communicator

This works @javiergn, thnxs

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

You can work an iteration of stats, and then use the transpose command to work with this and format it how you want..

See: Transpose : http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Transpose

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...