Refine your search:

I'm trying to format the output from Windows perflogs into a nice table. The way the events are formatted, with separate events with "object" and "Value" fields each, has thrown my brain for a loop. How would I change this table:

host    object  Value
HOSTA   PagingFile  11.070782
HOSTA   Processor   4.480732
HOSTB   PagingFile  13.441306
HOSTB   Processor   7.368559

Into

host    PagingFile  Processor
HOSTA   11.070782   4.480732
HOSTB   13.441306   7.368559

The original search:

index=perflog CPU OR pagefile | stats avg(Value) as Value by host object

asked 29 Jun '12, 11:34

twinspop's gravatar image

twinspop
6567644
accept rate: 40%


One Answer:

Use chart instead of stats.

index=perflog CPU or pagefile | chart avg(value) by host,object
link

answered 29 Jun '12, 12:00

Ayn's gravatar image

Ayn ♦
34.5k3817
accept rate: 40%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×408
×310
×285
×71
×50

Asked: 29 Jun '12, 11:34

Seen: 1,330 times

Last updated: 29 Jun '12, 12:00

Copyright © 2005-2014 Splunk Inc. All rights reserved.