In a table output that uses the stats command, how do you convert a row to a header?

[dtakacssplunk]

How do I convert the output of a table from stats command that looks like this:

TIME VALUE METRIC
time1 a 100
time1 b 200
time2 a 50
time2 b 90

To this?

TIME a b

time1 100 200
time2 50 90

[kamlesh_vaghela]

Hi @dtakacssplunk,

You can use chart also.

YOUR_SEARCH | chart values(METRIC) as METRIC over TIME by VALUE

Sample Search:

| makeresults | eval _raw="
TIME VALUE METRIC
time1 a 100
time1 b 200
time2 a 50
time2 b 90
" | multikv | chart values(METRIC) as METRIC over TIME by VALUE

Thanks

[chrisyounger · Accepted solution]

Hi @dtakacssplunk

xyseries will also do what you want

e.g.
index=_internal | eval len = len(_raw) |stats count by component log_level | head 10
becomes
index=_internal | eval len = len(_raw) |stats count by component log_level | head 10 | xyseries component log_level count

Good luck!

[renjith_nair]

@dtakacssplunk,

Try,

"your current search "
|eval {VALUE}=METRIC|fields - VALUE,METRIC|stats values(*) as * by TIME