Splunk Search

Table columns and rows transposition

twinspop
Influencer

I'm trying to format the output from Windows perflogs into a nice table. The way the events are formatted, with separate events with "object" and "Value" fields each, has thrown my brain for a loop. How would I change this table:

host    object  Value
HOSTA   PagingFile  11.070782
HOSTA   Processor   4.480732
HOSTB   PagingFile  13.441306
HOSTB   Processor   7.368559

Into

host    PagingFile  Processor
HOSTA   11.070782   4.480732
HOSTB   13.441306   7.368559

The original search:

index=perflog CPU OR pagefile | stats avg(Value) as Value by host object  
1 Solution

Ayn
Legend

Use chart instead of stats.

index=perflog CPU or pagefile | chart avg(value) by host,object

View solution in original post

Ayn
Legend

Use chart instead of stats.

index=perflog CPU or pagefile | chart avg(value) by host,object
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...