Splunk Search

Produce single row by combining multiple row and column

Naveenkumar
Engager

Hi Splunk,

I have a table like below

Component Green Amber Red

Resp_time 0 200 400

5xx 0 50 100

4xx 0 50 100

 

I want to combine them to produce single row like below

Resp_time_Green  Resp_time_Amber Resp_time_Red 5xx_Green 5xx_Amber 5xx_Red 4xx_Green 4xx_Amber 4xx_Red

0 200 400 0 50 100 0 50 100

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| untable Component Level count
| eval Component_Level=Component."_".Level
| table Component_Level count
| transpose 0 header_field=Component_Level
| fields - column

View solution in original post

Naveenkumar
Engager

Thanks! Works like a charm!

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Please accept that solution as it works.

ITWhisperer
SplunkTrust
SplunkTrust
| untable Component Level count
| eval Component_Level=Component."_".Level
| table Component_Level count
| transpose 0 header_field=Component_Level
| fields - column
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...