Splunk Search

Tranpose the output result

bijodev1
Communicator

Hi There,

I have got some results in after running the below command

my search | 
| bucket _time span=1h
| stats count by _time http_status
| eventstats sum(count) as totalCount by _time
| eval percent=round((count/totalCount),3)*100
| fields - count - totalCount

Output is as follows

time                                      status                    percent

2022-03-02 05:30:0010010.0
2022-03-02 05:30:0020030.0
2022-03-02 05:30:0030060.0
2022-03-02 06:30:0010030.0
2022-03-02 06:30:0020060.0
2022-03-02 07:30:0030010.0
2022-03-02 07:30:0010020.0
2022-03-02 07:30:0020030.0
2022-03-02 06:30:0030050.0

 

I am trying to transpose the output as below :

time                                     100                        200     300 

2022-03-02 05:30:0010.030.060.0
2022-03-02 06:30:0030.060.010.0
2022-03-02 07:30:0020.030.050.0

 

please assist

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| xyseries time status percent

View solution in original post

bijodev1
Communicator

@ITWhisperer  thank you so much, it worked as expected

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| xyseries time status percent
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...