Splunk Search

how to rearrange the table/chart layout

zoe
Explorer

Hi, 

I have:

index=............|stats avg(test) by OrderNr Sub_OrderNr

zoe_0-1617712172861.png

But I want to something like this:

OrderNr       Sub_OrderNr_1   Sub_OrderNr_2

xxxxxx           avg(test)                avg(test)

 

How shall I change the search? 

Thank you for your help!

 

 

Labels (3)
0 Karma

ITWhisperer
Ultra Champion
| makeresults 
| eval _raw="OrderNr,Sub_OrderNr,avgTest
1001118478,1,1.73
1001118478,2,1.79
1001118479,1,1.755
1001118479,2,1.75
1001129608,1,1.6
1001129608,2,1.615"
| multikv forceheader=1
| fields - _time linecount _raw


| eval Sub_OrderNr="Sub_OrderNr_".Sub_OrderNr
| xyseries OrderNr Sub_OrderNr avgTest
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!