Splunk Search

how to transform from row to rows ?

cuongnguyen112
Engager

i have data like this :
used_memory free_memory total_memory used_swap free_swap total_swap
665268 6987204 7652472 0 0 0

is there any way to transform to this :

Type Total Used Free
Memory 7652472 665268 6987204
Swap 0 0 0

Please some one help !

Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi cuongnguyen112,
try something like this

| makeresults 
| eval used_memory=665268, free_memory=6987204, total_memory=7652472, used_swap=0, free_swap=0, total_swap=0
| fieldsummary
| eval Type=case(field="free_memory","Memory",field="total_memory","Memory",field="used_memory","Memory",field="free_swap","Swap",field="total_swap","Swap",field="used_swap","Swap")
| eval Kind=case(field="free_memory","free",field="total_memory","total",field="used_memory","used",field="free_swap","free",field="total_swap","total",field="used_swap","used")
| chart max(max) over Type BY Kind

Ciao.
Giuseppe

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval _raw="used_memory free_memory total_memory used_swap free_swap total_swap
665268 6987204 7652472 0 0 0"
| multikv
0 Karma

to4kawa
Ultra Champion
| stats count
| eval _raw="used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
665268,6987204,7652472,0,0,0"
| multikv forceheader=1
| fields used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
| eval tmp=1
| untable tmp memory bytes
| eval Type=case(like(memory,"%memory"),"Memory",like(memory,"%swap"),"Swap")
| stats sum(eval(if(memory=="total_memory",bytes,0))) as Total
 ,sum(eval(if(memory=="used_memory",bytes,0))) as Used
 ,sum(eval(if(memory=="free_memory",bytes,0))) as Free by Type

OR

| stats count
| eval _raw="used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
665268,6987204,7652472,0,0,0"
| multikv forceheader=1
| fields used_memory,free_memory,total_memory,used_swap,free_swap,total_swap
| eval tmp=1
| untable tmp memory bytes
| eval Type=case(like(memory,"%memory"),"Memory",like(memory,"%swap"),"Swap")
| xyseries Type memory bytes
| eval Free=coalesce(free_memory,free_swap)
| eval Total=coalesce(total_memory,total_swap)
| eval Used=coalesce(used_memory,used_swap)
| fields Type Total Used Free

Hi, how about this?

0 Karma

cuongnguyen112
Engager

totally worked, but i can only accept one, ty so much btw 😄

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi cuongnguyen112,
try something like this

| makeresults 
| eval used_memory=665268, free_memory=6987204, total_memory=7652472, used_swap=0, free_swap=0, total_swap=0
| fieldsummary
| eval Type=case(field="free_memory","Memory",field="total_memory","Memory",field="used_memory","Memory",field="free_swap","Swap",field="total_swap","Swap",field="used_swap","Swap")
| eval Kind=case(field="free_memory","free",field="total_memory","total",field="used_memory","used",field="free_swap","free",field="total_swap","total",field="used_swap","used")
| chart max(max) over Type BY Kind

Ciao.
Giuseppe

0 Karma

cuongnguyen112
Engager

it work like a charm, ty so much

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...