Splunk Search

Transposing a table with _time as header and grouping the results

dojiepreji
Path Finder

Hello all,

I currently have a search that produces the following output:

alt text

This is the result of multiple append and join columns.

I would like to transpose the table to this:
alt text

I've tried to use | transpose, but I simply couldn't get it to appear the way I want it. The whole data for Level 1 disappears.

Can anybody please point me in the right direction?

0 Karma
1 Solution

Sukisen1981
Champion

try this

|eval {_time}=performance|fields - time,- performance|stats values(20*) by critname|rename values(* as ""* , *) as *""

you can also refer to my eaelier answer here on something similar if this does not give you the exact output - https://answers.splunk.com/answers/769617/how-to-extract-values-from-field-and-use-it-as-col.html#an...

View solution in original post

0 Karma

gcusello
Legend

Hi dojiepreji,
did yu checked the possibility to use chart command?
something like this

| index=my_index
| bin span=1y _time
| chart count over critName BY _time

Ciao.
Giuseppe

0 Karma

Sukisen1981
Champion

try this

|eval {_time}=performance|fields - time,- performance|stats values(20*) by critname|rename values(* as ""* , *) as *""

you can also refer to my eaelier answer here on something similar if this does not give you the exact output - https://answers.splunk.com/answers/769617/how-to-extract-values-from-field-and-use-it-as-col.html#an...

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...