Splunk Search
Highlighted

reformating stats and eval output as columns and rows

New Member

I have the below search to output the values for response times for an application,

index="summary_application_responcetimes" | stats 
max(CorpWeb_ResponceTime) as CorpWeb_ResponceTime 
max(DPSCC_ResponceTime) as DPSCC_ResponceTime 
max(TotalUser_ResponceTime) as TotalUser_ResponceTime 
| eval CorpWeb_Status=if(CorpWeb_ResponceTime > 30, 1, 0) 
| eval DPSCC_Status=if(DPSCC_ResponceTime> 10, 1, 0) 
| eval TotalUser_Status=if(TotalUser_ResponceTime > 30, 1, 0)
| eval MyApp = if(DPSCC_Status + CorpWeb_Status >= 1, 1, 0)

----------
The output is a single row with multiple columns

CorpWeb_ResponceTime DPSCC_ResponceTime TotalUser_ResponceTime CorpWeb_Status DPSCC_Status TotalUser_Status MyApp
2.802000000      5.93600000         60.115000000           0              0            1                 1
----------

but what I want is two columns with the values in the rows.

            ResponceTime    Status
CorpWeb     2.802000000         0
DPSCC       5.936000000         0
TotalUser   60.115000000        1
MyApp                           1

I have tried subsearchs and appendcols as well as transpose, Im sure its relatively straight forward but I can get the commands/syntax correct

Tags (3)
0 Karma
Highlighted

Re: reformating stats and eval output as columns and rows

Influencer

untable is your friend

... | untable "" measure value
    | rex field=measure "(?<field>[^_]+)(?:_(?<metric>.*))?"
    | fillnull value="Status" metric
    | xyseries field metric value

Add the lines 1 by one to see what they do.

alt text

View solution in original post

Highlighted

Re: reformating stats and eval output as columns and rows

New Member

perfect thanks.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.