Splunk Search

how to rearrange the table/chart layout

zoe
Explorer

Hi, 

I have:

index=............|stats avg(test) by OrderNr Sub_OrderNr

zoe_0-1617712172861.png

But I want to something like this:

OrderNr       Sub_OrderNr_1   Sub_OrderNr_2

xxxxxx           avg(test)                avg(test)

 

How shall I change the search? 

Thank you for your help!

 

 

Labels (3)
0 Karma

ITWhisperer
Legend
| makeresults 
| eval _raw="OrderNr,Sub_OrderNr,avgTest
1001118478,1,1.73
1001118478,2,1.79
1001118479,1,1.755
1001118479,2,1.75
1001129608,1,1.6
1001129608,2,1.615"
| multikv forceheader=1
| fields - _time linecount _raw


| eval Sub_OrderNr="Sub_OrderNr_".Sub_OrderNr
| xyseries OrderNr Sub_OrderNr avgTest
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.