Splunk Search

Table columns and rows transposition

twinspop
Influencer

I'm trying to format the output from Windows perflogs into a nice table. The way the events are formatted, with separate events with "object" and "Value" fields each, has thrown my brain for a loop. How would I change this table:

host    object  Value
HOSTA   PagingFile  11.070782
HOSTA   Processor   4.480732
HOSTB   PagingFile  13.441306
HOSTB   Processor   7.368559

Into

host    PagingFile  Processor
HOSTA   11.070782   4.480732
HOSTB   13.441306   7.368559

The original search:

index=perflog CPU OR pagefile | stats avg(Value) as Value by host object  
1 Solution

Ayn
Legend

Use chart instead of stats.

index=perflog CPU or pagefile | chart avg(value) by host,object

View solution in original post

Ayn
Legend

Use chart instead of stats.

index=perflog CPU or pagefile | chart avg(value) by host,object
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

ATTENTION: We’re Moving! (AGAIN!)

The Splunk Community Slack is undergoing a system migration to keep our workspace secure and ...

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

In this session, we will peel back the layers of Splunk Observability Cloud’s cost-optimization features. ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...