Splunk Search

Reformat table so values become Column headings

Contributor

I have a search that ends with

| stats sum(count) AS Hits by time GUID csuri_stem

Which results in a table

alt text

I would like to reformat the table as follows, but have had some difficulty.

alt text

Any help much appreciated!

0 Karma
1 Solution

Motivator

Hi DanielFordWA,

Try the below search,

... | stats sum(count) AS Hits by _time GUID cs_uri_stem | eval time=strftime(_time,"%+") | eval temp=time+"##"+GUID| table temp cs_uri_stem Hits | xyseries temp, cs_uri_stem Hits | fillnull | rex field=temp "(?<time>.*)##(?<GUID>.*)" | fields - temp | table time, GUID *

I have combined _time and GUID by "##" named as temp field, used xyseries to format the results as you expect. later extract the time and GUID from temp field.

Hope this will solve your problem.

Thanks,
V

View solution in original post

Motivator

Hi DanielFordWA,

Try the below search,

... | stats sum(count) AS Hits by _time GUID cs_uri_stem | eval time=strftime(_time,"%+") | eval temp=time+"##"+GUID| table temp cs_uri_stem Hits | xyseries temp, cs_uri_stem Hits | fillnull | rex field=temp "(?<time>.*)##(?<GUID>.*)" | fields - temp | table time, GUID *

I have combined _time and GUID by "##" named as temp field, used xyseries to format the results as you expect. later extract the time and GUID from temp field.

Hope this will solve your problem.

Thanks,
V

View solution in original post