Splunk Search

how to transform from row to rows ?

cuongnguyen112
Engager

i have data like this :
used_memory free_memory total_memory used_swap free_swap total_swap
665268 6987204 7652472 0 0 0

is there any way to transform to this :

Type Total Used Free
Memory 7652472 665268 6987204
Swap 0 0 0

Please some one help !

Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi cuongnguyen112,
try something like this

| makeresults 
| eval used_memory=665268, free_memory=6987204, total_memory=7652472, used_swap=0, free_swap=0, total_swap=0
| fieldsummary
| eval Type=case(field="free_memory","Memory",field="total_memory","Memory",field="used_memory","Memory",field="free_swap","Swap",field="total_swap","Swap",field="used_swap","Swap")
| eval Kind=case(field="free_memory","free",field="total_memory","total",field="used_memory","used",field="free_swap","free",field="total_swap","total",field="used_swap","used")
| chart max(max) over Type BY Kind

Ciao.
Giuseppe

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval _raw="used_memory free_memory total_memory used_swap free_swap total_swap
665268 6987204 7652472 0 0 0"
| multikv
0 Karma

to4kawa
Ultra Champion
| stats count
| eval _raw="used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
665268,6987204,7652472,0,0,0"
| multikv forceheader=1
| fields used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
| eval tmp=1
| untable tmp memory bytes
| eval Type=case(like(memory,"%memory"),"Memory",like(memory,"%swap"),"Swap")
| stats sum(eval(if(memory=="total_memory",bytes,0))) as Total
 ,sum(eval(if(memory=="used_memory",bytes,0))) as Used
 ,sum(eval(if(memory=="free_memory",bytes,0))) as Free by Type

OR

| stats count
| eval _raw="used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
665268,6987204,7652472,0,0,0"
| multikv forceheader=1
| fields used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
| eval tmp=1
| untable tmp memory bytes
| eval Type=case(like(memory,"%memory"),"Memory",like(memory,"%swap"),"Swap")
| xyseries Type memory bytes
| eval Free=coalesce(free_memory,free_swap)
| eval Total=coalesce(total_memory,total_swap)
| eval Used=coalesce(used_memory,used_swap)
| fields Type Total Used Free

Hi, how about this?

0 Karma

cuongnguyen112
Engager

totally worked, but i can only accept one, ty so much btw 😄

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi cuongnguyen112,
try something like this

| makeresults 
| eval used_memory=665268, free_memory=6987204, total_memory=7652472, used_swap=0, free_swap=0, total_swap=0
| fieldsummary
| eval Type=case(field="free_memory","Memory",field="total_memory","Memory",field="used_memory","Memory",field="free_swap","Swap",field="total_swap","Swap",field="used_swap","Swap")
| eval Kind=case(field="free_memory","free",field="total_memory","total",field="used_memory","used",field="free_swap","free",field="total_swap","total",field="used_swap","used")
| chart max(max) over Type BY Kind

Ciao.
Giuseppe

0 Karma

cuongnguyen112
Engager

it work like a charm, ty so much

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...