Splunk Search
Highlighted

How to write a search to convert columns to rows?

Engager

I need to convert the following source data as a specified output.

Source Data

 API    SUCCESS    FAIL    POLICY    TOTAL
 x        2         3        4         9

Need a search to convert as following

 API    Measure    Count
  x     SUCCESS      2
  x      FAIL        3
  X     POLICY       4
  x      Total      9

Any inputs?

Highlighted

Re: How to write a search to convert columns to rows?

Super Champion

You can work an iteration of stats, and then use the transpose command to work with this and format it how you want..

See: Transpose : http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Transpose

0 Karma
Highlighted

Re: How to write a search to convert columns to rows?

SplunkTrust
SplunkTrust

I would just do it this way:

your search here
| untable API Measure Count

I replicated your use case with the following CSV:

API, SUCCESS, FAIL, POLICY, TOTAL
x, 2, 3, 4, 9

And tested it with the following query:

| inputcsv mycsv.csv
| untable API Measure Count

And the output is: see attached image.

alt text

View solution in original post

Highlighted

Re: How to write a search to convert columns to rows?

Communicator

This works @javiergn, thnxs

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.