Splunk Search

how to transform from row to rows ?

cuongnguyen112
Engager

i have data like this :
used_memory free_memory total_memory used_swap free_swap total_swap
665268 6987204 7652472 0 0 0

is there any way to transform to this :

Type Total Used Free
Memory 7652472 665268 6987204
Swap 0 0 0

Please some one help !

Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi cuongnguyen112,
try something like this

| makeresults 
| eval used_memory=665268, free_memory=6987204, total_memory=7652472, used_swap=0, free_swap=0, total_swap=0
| fieldsummary
| eval Type=case(field="free_memory","Memory",field="total_memory","Memory",field="used_memory","Memory",field="free_swap","Swap",field="total_swap","Swap",field="used_swap","Swap")
| eval Kind=case(field="free_memory","free",field="total_memory","total",field="used_memory","used",field="free_swap","free",field="total_swap","total",field="used_swap","used")
| chart max(max) over Type BY Kind

Ciao.
Giuseppe

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval _raw="used_memory free_memory total_memory used_swap free_swap total_swap
665268 6987204 7652472 0 0 0"
| multikv
0 Karma

to4kawa
Ultra Champion
| stats count
| eval _raw="used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
665268,6987204,7652472,0,0,0"
| multikv forceheader=1
| fields used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
| eval tmp=1
| untable tmp memory bytes
| eval Type=case(like(memory,"%memory"),"Memory",like(memory,"%swap"),"Swap")
| stats sum(eval(if(memory=="total_memory",bytes,0))) as Total
 ,sum(eval(if(memory=="used_memory",bytes,0))) as Used
 ,sum(eval(if(memory=="free_memory",bytes,0))) as Free by Type

OR

| stats count
| eval _raw="used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
665268,6987204,7652472,0,0,0"
| multikv forceheader=1
| fields used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
| eval tmp=1
| untable tmp memory bytes
| eval Type=case(like(memory,"%memory"),"Memory",like(memory,"%swap"),"Swap")
| xyseries Type memory bytes
| eval Free=coalesce(free_memory,free_swap)
| eval Total=coalesce(total_memory,total_swap)
| eval Used=coalesce(used_memory,used_swap)
| fields Type Total Used Free

Hi, how about this?

0 Karma

cuongnguyen112
Engager

totally worked, but i can only accept one, ty so much btw 😄

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi cuongnguyen112,
try something like this

| makeresults 
| eval used_memory=665268, free_memory=6987204, total_memory=7652472, used_swap=0, free_swap=0, total_swap=0
| fieldsummary
| eval Type=case(field="free_memory","Memory",field="total_memory","Memory",field="used_memory","Memory",field="free_swap","Swap",field="total_swap","Swap",field="used_swap","Swap")
| eval Kind=case(field="free_memory","free",field="total_memory","total",field="used_memory","used",field="free_swap","free",field="total_swap","total",field="used_swap","used")
| chart max(max) over Type BY Kind

Ciao.
Giuseppe

0 Karma

cuongnguyen112
Engager

it work like a charm, ty so much

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...