Splunk Search

Table columns and rows transposition

twinspop
Influencer

I'm trying to format the output from Windows perflogs into a nice table. The way the events are formatted, with separate events with "object" and "Value" fields each, has thrown my brain for a loop. How would I change this table:

host    object  Value
HOSTA   PagingFile  11.070782
HOSTA   Processor   4.480732
HOSTB   PagingFile  13.441306
HOSTB   Processor   7.368559

Into

host    PagingFile  Processor
HOSTA   11.070782   4.480732
HOSTB   13.441306   7.368559

The original search:

index=perflog CPU OR pagefile | stats avg(Value) as Value by host object  
1 Solution

Ayn
Legend

Use chart instead of stats.

index=perflog CPU or pagefile | chart avg(value) by host,object

View solution in original post

Ayn
Legend

Use chart instead of stats.

index=perflog CPU or pagefile | chart avg(value) by host,object
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...