Splunk Search

reformating stats and eval output as columns and rows

rickl
New Member

I have the below search to output the values for response times for an application,

index="summary_application_responcetimes" | stats 
max(CorpWeb_ResponceTime) as CorpWeb_ResponceTime 
max(DPSCC_ResponceTime) as DPSCC_ResponceTime 
max(TotalUser_ResponceTime) as TotalUser_ResponceTime 
| eval CorpWeb_Status=if(CorpWeb_ResponceTime > 30, 1, 0) 
| eval DPSCC_Status=if(DPSCC_ResponceTime> 10, 1, 0) 
| eval TotalUser_Status=if(TotalUser_ResponceTime > 30, 1, 0)
| eval MyApp = if(DPSCC_Status + CorpWeb_Status >= 1, 1, 0)

----------
The output is a single row with multiple columns

CorpWeb_ResponceTime DPSCC_ResponceTime TotalUser_ResponceTime CorpWeb_Status DPSCC_Status TotalUser_Status MyApp
2.802000000      5.93600000         60.115000000           0              0            1                 1
----------

but what I want is two columns with the values in the rows.

            ResponceTime    Status
CorpWeb     2.802000000         0
DPSCC       5.936000000         0
TotalUser   60.115000000        1
MyApp                           1

I have tried subsearchs and appendcols as well as transpose, Im sure its relatively straight forward but I can get the commands/syntax correct

Tags (3)
0 Karma
1 Solution

jonuwz
Influencer

untable is your friend

... | untable "" measure value
    | rex field=measure "(?<field>[^_]+)(?:_(?<metric>.*))?"
    | fillnull value="Status" metric
    | xyseries field metric value

Add the lines 1 by one to see what they do.

alt text

View solution in original post

jonuwz
Influencer

untable is your friend

... | untable "" measure value
    | rex field=measure "(?<field>[^_]+)(?:_(?<metric>.*))?"
    | fillnull value="Status" metric
    | xyseries field metric value

Add the lines 1 by one to see what they do.

alt text

rickl
New Member

perfect thanks.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...