Splunk Search

how to transpose rows into multiple columns based on grouping?

trkalva
Engager

Hi,

I have a query which fetches me the below result in a table:

Thread | Total_Run_Time

READER_1_1_1 303.971798

READER_1_1_1 151.724136

READER_1_2_1 303.97251

READER_1_2_1 151.728481

TRANSF_1_1_1 310.477318

TRANSF_1_1_1 157.788452

TRANSF_1_2_1 310.480424

TRANSF_1_2_1 157.791372

WRITER_1_*_1 310.985073

WRITER_1_*_1 159.198983

I want all the distinct values(number is dynamic) under 'Thread' as columns with corresponding values from Total_Run_Time

I need the result like this:

READER_1_1_1_Total_Run_Time | READER_1_2_1_Total_Run_Time | TRANSF_1_1_1_Total_Run_Time | TRANSF_1_2_1_Total_Run_Time | WRITER_1_*_1_Total_Run_Time

303.971798 303.97251 310.477318 310.480424 310.985073

151.724136 151.728481 157.788452 157.791372 159.198983


Edit based on the suggestion:


The query suggested by asimagu "| chart list(Total_Run_Time) over date_hour by Thread" gave the below result:

date_hour READER_1_1_1 READER_1_2_1 TRANSF_1_1_1 TRANSF_\1_\2_1 WRITER_\1_*_\1


17 (303.971798 151.724136) (303.97251 151.728481) (310.477318 157.788452) (310.480424 157.791372) (310.985073 159.198983)

How to make a line chart of true values of these fields by columns (like READER_1_1_1 with 303.971798, 151.724136) as these are multivalue fields?

please suggest

Tags (3)
0 Karma
1 Solution

asimagu
Builder

have a play with

chart over by

that should do the magic, I don't know what your search looks like but maybe play putting your field names in one or other position in the command I just gave you

View solution in original post

asimagu
Builder

have a play with

chart over by

that should do the magic, I don't know what your search looks like but maybe play putting your field names in one or other position in the command I just gave you

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...