Splunk Search

how to transform from row to rows ?

cuongnguyen112
Engager

i have data like this :
used_memory free_memory total_memory used_swap free_swap total_swap
665268 6987204 7652472 0 0 0

is there any way to transform to this :

Type Total Used Free
Memory 7652472 665268 6987204
Swap 0 0 0

Please some one help !

Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi cuongnguyen112,
try something like this

| makeresults 
| eval used_memory=665268, free_memory=6987204, total_memory=7652472, used_swap=0, free_swap=0, total_swap=0
| fieldsummary
| eval Type=case(field="free_memory","Memory",field="total_memory","Memory",field="used_memory","Memory",field="free_swap","Swap",field="total_swap","Swap",field="used_swap","Swap")
| eval Kind=case(field="free_memory","free",field="total_memory","total",field="used_memory","used",field="free_swap","free",field="total_swap","total",field="used_swap","used")
| chart max(max) over Type BY Kind

Ciao.
Giuseppe

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval _raw="used_memory free_memory total_memory used_swap free_swap total_swap
665268 6987204 7652472 0 0 0"
| multikv
0 Karma

to4kawa
Ultra Champion
| stats count
| eval _raw="used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
665268,6987204,7652472,0,0,0"
| multikv forceheader=1
| fields used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
| eval tmp=1
| untable tmp memory bytes
| eval Type=case(like(memory,"%memory"),"Memory",like(memory,"%swap"),"Swap")
| stats sum(eval(if(memory=="total_memory",bytes,0))) as Total
 ,sum(eval(if(memory=="used_memory",bytes,0))) as Used
 ,sum(eval(if(memory=="free_memory",bytes,0))) as Free by Type

OR

| stats count
| eval _raw="used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
665268,6987204,7652472,0,0,0"
| multikv forceheader=1
| fields used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
| eval tmp=1
| untable tmp memory bytes
| eval Type=case(like(memory,"%memory"),"Memory",like(memory,"%swap"),"Swap")
| xyseries Type memory bytes
| eval Free=coalesce(free_memory,free_swap)
| eval Total=coalesce(total_memory,total_swap)
| eval Used=coalesce(used_memory,used_swap)
| fields Type Total Used Free

Hi, how about this?

0 Karma

cuongnguyen112
Engager

totally worked, but i can only accept one, ty so much btw 😄

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi cuongnguyen112,
try something like this

| makeresults 
| eval used_memory=665268, free_memory=6987204, total_memory=7652472, used_swap=0, free_swap=0, total_swap=0
| fieldsummary
| eval Type=case(field="free_memory","Memory",field="total_memory","Memory",field="used_memory","Memory",field="free_swap","Swap",field="total_swap","Swap",field="used_swap","Swap")
| eval Kind=case(field="free_memory","free",field="total_memory","total",field="used_memory","used",field="free_swap","free",field="total_swap","total",field="used_swap","used")
| chart max(max) over Type BY Kind

Ciao.
Giuseppe

0 Karma

cuongnguyen112
Engager

it work like a charm, ty so much

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...