Splunk Search

how to transpose rows into multiple columns based on grouping?

trkalva
Engager

Hi,

I have a query which fetches me the below result in a table:

Thread | Total_Run_Time

READER_1_1_1 303.971798

READER_1_1_1 151.724136

READER_1_2_1 303.97251

READER_1_2_1 151.728481

TRANSF_1_1_1 310.477318

TRANSF_1_1_1 157.788452

TRANSF_1_2_1 310.480424

TRANSF_1_2_1 157.791372

WRITER_1_*_1 310.985073

WRITER_1_*_1 159.198983

I want all the distinct values(number is dynamic) under 'Thread' as columns with corresponding values from Total_Run_Time

I need the result like this:

READER_1_1_1_Total_Run_Time | READER_1_2_1_Total_Run_Time | TRANSF_1_1_1_Total_Run_Time | TRANSF_1_2_1_Total_Run_Time | WRITER_1_*_1_Total_Run_Time

303.971798 303.97251 310.477318 310.480424 310.985073

151.724136 151.728481 157.788452 157.791372 159.198983


Edit based on the suggestion:


The query suggested by asimagu "| chart list(Total_Run_Time) over date_hour by Thread" gave the below result:

date_hour READER_1_1_1 READER_1_2_1 TRANSF_1_1_1 TRANSF_\1_\2_1 WRITER_\1_*_\1


17 (303.971798 151.724136) (303.97251 151.728481) (310.477318 157.788452) (310.480424 157.791372) (310.985073 159.198983)

How to make a line chart of true values of these fields by columns (like READER_1_1_1 with 303.971798, 151.724136) as these are multivalue fields?

please suggest

Tags (3)
0 Karma
1 Solution

asimagu
Builder

have a play with

chart over by

that should do the magic, I don't know what your search looks like but maybe play putting your field names in one or other position in the command I just gave you

View solution in original post

asimagu
Builder

have a play with

chart over by

that should do the magic, I don't know what your search looks like but maybe play putting your field names in one or other position in the command I just gave you

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...