Splunk Search

how to transpose rows into multiple columns based on grouping?

trkalva
Engager

Hi,

I have a query which fetches me the below result in a table:

Thread | Total_Run_Time

READER_1_1_1 303.971798

READER_1_1_1 151.724136

READER_1_2_1 303.97251

READER_1_2_1 151.728481

TRANSF_1_1_1 310.477318

TRANSF_1_1_1 157.788452

TRANSF_1_2_1 310.480424

TRANSF_1_2_1 157.791372

WRITER_1_*_1 310.985073

WRITER_1_*_1 159.198983

I want all the distinct values(number is dynamic) under 'Thread' as columns with corresponding values from Total_Run_Time

I need the result like this:

READER_1_1_1_Total_Run_Time | READER_1_2_1_Total_Run_Time | TRANSF_1_1_1_Total_Run_Time | TRANSF_1_2_1_Total_Run_Time | WRITER_1_*_1_Total_Run_Time

303.971798 303.97251 310.477318 310.480424 310.985073

151.724136 151.728481 157.788452 157.791372 159.198983


Edit based on the suggestion:


The query suggested by asimagu "| chart list(Total_Run_Time) over date_hour by Thread" gave the below result:

date_hour READER_1_1_1 READER_1_2_1 TRANSF_1_1_1 TRANSF_\1_\2_1 WRITER_\1_*_\1


17 (303.971798 151.724136) (303.97251 151.728481) (310.477318 157.788452) (310.480424 157.791372) (310.985073 159.198983)

How to make a line chart of true values of these fields by columns (like READER_1_1_1 with 303.971798, 151.724136) as these are multivalue fields?

please suggest

Tags (3)
0 Karma
1 Solution

asimagu
Builder

have a play with

chart over by

that should do the magic, I don't know what your search looks like but maybe play putting your field names in one or other position in the command I just gave you

View solution in original post

asimagu
Builder

have a play with

chart over by

that should do the magic, I don't know what your search looks like but maybe play putting your field names in one or other position in the command I just gave you

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Data Management Digest – August 2026

MichelleCorpora_1-1788182384472.png Welcome to the August 2026 edition of Data Management Digest! August was a ...

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...