Splunk Search

how to transform from row to rows ?

cuongnguyen112
Engager

i have data like this :
used_memory free_memory total_memory used_swap free_swap total_swap
665268 6987204 7652472 0 0 0

is there any way to transform to this :

Type Total Used Free
Memory 7652472 665268 6987204
Swap 0 0 0

Please some one help !

Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi cuongnguyen112,
try something like this

| makeresults 
| eval used_memory=665268, free_memory=6987204, total_memory=7652472, used_swap=0, free_swap=0, total_swap=0
| fieldsummary
| eval Type=case(field="free_memory","Memory",field="total_memory","Memory",field="used_memory","Memory",field="free_swap","Swap",field="total_swap","Swap",field="used_swap","Swap")
| eval Kind=case(field="free_memory","free",field="total_memory","total",field="used_memory","used",field="free_swap","free",field="total_swap","total",field="used_swap","used")
| chart max(max) over Type BY Kind

Ciao.
Giuseppe

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval _raw="used_memory free_memory total_memory used_swap free_swap total_swap
665268 6987204 7652472 0 0 0"
| multikv
0 Karma

to4kawa
Ultra Champion
| stats count
| eval _raw="used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
665268,6987204,7652472,0,0,0"
| multikv forceheader=1
| fields used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
| eval tmp=1
| untable tmp memory bytes
| eval Type=case(like(memory,"%memory"),"Memory",like(memory,"%swap"),"Swap")
| stats sum(eval(if(memory=="total_memory",bytes,0))) as Total
 ,sum(eval(if(memory=="used_memory",bytes,0))) as Used
 ,sum(eval(if(memory=="free_memory",bytes,0))) as Free by Type

OR

| stats count
| eval _raw="used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
665268,6987204,7652472,0,0,0"
| multikv forceheader=1
| fields used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
| eval tmp=1
| untable tmp memory bytes
| eval Type=case(like(memory,"%memory"),"Memory",like(memory,"%swap"),"Swap")
| xyseries Type memory bytes
| eval Free=coalesce(free_memory,free_swap)
| eval Total=coalesce(total_memory,total_swap)
| eval Used=coalesce(used_memory,used_swap)
| fields Type Total Used Free

Hi, how about this?

0 Karma

cuongnguyen112
Engager

totally worked, but i can only accept one, ty so much btw 😄

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi cuongnguyen112,
try something like this

| makeresults 
| eval used_memory=665268, free_memory=6987204, total_memory=7652472, used_swap=0, free_swap=0, total_swap=0
| fieldsummary
| eval Type=case(field="free_memory","Memory",field="total_memory","Memory",field="used_memory","Memory",field="free_swap","Swap",field="total_swap","Swap",field="used_swap","Swap")
| eval Kind=case(field="free_memory","free",field="total_memory","total",field="used_memory","used",field="free_swap","free",field="total_swap","total",field="used_swap","used")
| chart max(max) over Type BY Kind

Ciao.
Giuseppe

0 Karma

cuongnguyen112
Engager

it work like a charm, ty so much

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...