I have the below search to output the values for response times for an application,
index="summary_application_responcetimes" | stats
max(CorpWeb_ResponceTime) as CorpWeb_ResponceTime
max(DPSCC_ResponceTime) as DPSCC_ResponceTime
max(TotalUser_ResponceTime) as TotalUser_ResponceTime
| eval CorpWeb_Status=if(CorpWeb_ResponceTime > 30, 1, 0)
| eval DPSCC_Status=if(DPSCC_ResponceTime> 10, 1, 0)
| eval TotalUser_Status=if(TotalUser_ResponceTime > 30, 1, 0)
| eval MyApp = if(DPSCC_Status + CorpWeb_Status >= 1, 1, 0)
----------
The output is a single row with multiple columns
CorpWeb_ResponceTime DPSCC_ResponceTime TotalUser_ResponceTime CorpWeb_Status DPSCC_Status TotalUser_Status MyApp
2.802000000 5.93600000 60.115000000 0 0 1 1
----------
but what I want is two columns with the values in the rows.
ResponceTime Status
CorpWeb 2.802000000 0
DPSCC 5.936000000 0
TotalUser 60.115000000 1
MyApp 1
I have tried subsearchs and appendcols as well as transpose, Im sure its relatively straight forward but I can get the commands/syntax correct
untable is your friend
... | untable "" measure value
| rex field=measure "(?<field>[^_]+)(?:_(?<metric>.*))?"
| fillnull value="Status" metric
| xyseries field metric value
Add the lines 1 by one to see what they do.
untable is your friend
... | untable "" measure value
| rex field=measure "(?<field>[^_]+)(?:_(?<metric>.*))?"
| fillnull value="Status" metric
| xyseries field metric value
Add the lines 1 by one to see what they do.
perfect thanks.