Reformat table so values become Column headings

[DanielFordWA]

I have a search that ends with

| stats sum(count) AS Hits by _time GUID cs_uri_stem

Which results in a table

I would like to reformat the table as follows, but have had some difficulty.

Any help much appreciated!

[vasanthmss · Accepted solution]

Hi DanielFordWA,

Try the below search,

... | stats sum(count) AS Hits by _time GUID cs_uri_stem | eval time=strftime(_time,"%+") | eval temp=time+"##"+GUID| table temp cs_uri_stem Hits | xyseries temp, cs_uri_stem Hits | fillnull | rex field=temp "(?<time>.*)##(?<GUID>.*)" | fields - temp | table time, GUID *

I have combined _time and GUID by "##" named as temp field, used xyseries to format the results as you expect. later extract the time and GUID from temp field.

Hope this will solve your problem.

Thanks,
V