Splunk Search

How to write a search to convert some table rows as columns?

vemukira000
New Member

I need to convert the following source data as a specified output.

Source Data

Hostname    Event_time             Key           Value
P153        2015/07/28 03:00:00    Total Size    2048
P153        2015/07/28 03:00:00    Used Size     797
P153        2015/07/28 03:00:00    Avail Size    1251.38
P153        2015/07/28 03:15:00    Total Size    2048
P153        2015/07/28 03:15:00    Used Size     856
P153        2015/07/28 03:15:00    Avail Size    1147.38

Need a search to convert as following

EVENT_TIME            Total Size    Used Size    Avail Size
2015/07/28 03:00:00      2048          797        1251.38
2015/07/28 03:15:00      2048          856        1147.38
0 Karma

diogofgm
SplunkTrust
SplunkTrust

try this:

| chart values(total_size) as "Total Size" values(used_size) as "Used Size" values(avail_size) as "Avail Size" over Event_time

change the field names inside the values() to match your extracted fields.

------------
Hope I was able to help you. If so, some karma would be appreciated.
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...