Splunk Search

Transpose table columns and rows with stats

hbakker
Engager

Problem Statement: I have a query that outputs performance percentile statistics by operation methods. Example: |chart p50(duration), p75(duration) by method.

I want to be able to create a column chart so all the percentile results are stacked, meaning p50s stacked with P50s, P75s stacked with P75s). The problem is that my query returns the methods on the left as rows and the percentile as the column headings, so when chart it is stacking the values of the methods versus stacking the percentiles.

I tried using transpose, but that doesn't seem to work, because it gives me row 1, row2, etc and I cannot rename because the list of methods is dynamic. Thoughts?

Tags (1)
0 Karma

lguinn2
Legend
yoursearchhere
| stats p75(duration) as p75 p50(duration) as p50  by method

Yes, it is stats, not chart. But click into the "Results Chart" view. Then choose how you want the results displayed.

This solution leverages the fact that the rows and columns are named differently for stats.

HTH

0 Karma

hbakker
Engager

Thanks for the quick response. I switched to using stats. Without using transpose it is still giving me the same issue. And when I used transpose while it helped that the columns are named correct, the rows (methods) are still labelled row1, row2, row3 rather than the method labels. What am I missing?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...