Splunk Search

how to have a timechart table group by columns

muthvin
New Member

Hi,

Please help me in creating a table with timechart grouped by columns:
_time Products Service

ProductA ProductB ProductC ServiceD ServiceE ServiceF
xxxx assaaa assaaa assaaa assaaa assaaa assaaa
xxxx assaaa assaaa assaaa assaaa assaaa assaaa
xxxx assaaa assaaa assaaa assaaa assaaa assaaa
xxxx assaaa assaaa assaaa assaaa assaaa assaaa
xxxx assaaa assaaa assaaa assaaa assaaa assaaa
xxxx assaaa assaaa assaaa assaaa assaaa assaaa

Tags (2)
0 Karma

woodcock
Esteemed Legend

Very generally, like this:

... | timechart span=1d dc(*) values(*)

You can then trim back to use just the dc or values pieces that you need (I am not sure if you are counting or listing). Change 1d to whatever you need (this is 1 day).

0 Karma

nawneel
Communicator

Can you be please more specific with question ? is this your sample set of data ??

0 Karma

debanjankundu
Explorer

Can you please elaborate your quary to understand your question clearly

0 Karma

muthvin
New Member

I want a query to create a table with time stamp as column A
Products as column B and Services as Column C....then ColumnB (Products) should have 3 sub-column product A, B, c resp...like we use to have in Excel.

0 Karma

muthvin
New Member

Yes its just a sample data...

_time Products Services

ProductA Product B Product C ServiceA Service B Service C

0 Karma
Get Updates on the Splunk Community!

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...