Splunk Search

how to transpose rows into multiple columns based on grouping?

trkalva
Engager

Hi,

I have a query which fetches me the below result in a table:

Thread | Total_Run_Time

READER_1_1_1 303.971798

READER_1_1_1 151.724136

READER_1_2_1 303.97251

READER_1_2_1 151.728481

TRANSF_1_1_1 310.477318

TRANSF_1_1_1 157.788452

TRANSF_1_2_1 310.480424

TRANSF_1_2_1 157.791372

WRITER_1_*_1 310.985073

WRITER_1_*_1 159.198983

I want all the distinct values(number is dynamic) under 'Thread' as columns with corresponding values from Total_Run_Time

I need the result like this:

READER_1_1_1_Total_Run_Time | READER_1_2_1_Total_Run_Time | TRANSF_1_1_1_Total_Run_Time | TRANSF_1_2_1_Total_Run_Time | WRITER_1_*_1_Total_Run_Time

303.971798 303.97251 310.477318 310.480424 310.985073

151.724136 151.728481 157.788452 157.791372 159.198983


Edit based on the suggestion:


The query suggested by asimagu "| chart list(Total_Run_Time) over date_hour by Thread" gave the below result:

date_hour READER_1_1_1 READER_1_2_1 TRANSF_1_1_1 TRANSF_\1_\2_1 WRITER_\1_*_\1


17 (303.971798 151.724136) (303.97251 151.728481) (310.477318 157.788452) (310.480424 157.791372) (310.985073 159.198983)

How to make a line chart of true values of these fields by columns (like READER_1_1_1 with 303.971798, 151.724136) as these are multivalue fields?

please suggest

Tags (3)
0 Karma
1 Solution

asimagu
Builder

have a play with

chart over by

that should do the magic, I don't know what your search looks like but maybe play putting your field names in one or other position in the command I just gave you

View solution in original post

asimagu
Builder

have a play with

chart over by

that should do the magic, I don't know what your search looks like but maybe play putting your field names in one or other position in the command I just gave you

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...