Splunk Search

transpose but with one column being a group by column

Contributor

Hi,

So at the current state of my search results in following format:

key fieldname   fieldvalue
k1  name1           0 day
k1  name2           N/A
k2  name1           0 day

I want it to be something like following but I am not sure how to achieve this.

key   name1 name2
k1    0 day N/A
k2    0 day       

Thanks,
Harsh

0 Karma
1 Solution

Builder

Try putting this at the end:
| xyseries key fieldname fieldvalue

View solution in original post

Builder

Try putting this at the end:
| xyseries key fieldname fieldvalue

View solution in original post

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!