Splunk Search

How to transpose or untable and keep only one column?

mrg2k8
Explorer

Hello,

I have a search returning some results that look like this:

sourcetype="somesourcetype" [ search sourcetype="somesourcetype" ... | top limit=100 email | fields + email ] | stats count by email,error

email           error       count
g@gogo.com      100         20
g@gogo.com      101         21
g@gogo.com      102         22
g@gogo.com      103         23
g@gogo.com      104         24
m@momo.com      100         20
m@momo.com      101         21
m@momo.com      102         22
m@momo.com      103         23
m@momo.com      104         24
f@fofo.com      100         20
f@fofo.com      101         21
f@fofo.com      102         22
f@fofo.com      103         23
f@fofo.com      104         24

How can I make my table look like this?

email           100     101     102     103     104
g@gogo.com      20      21      22      23      24
m@momo.com      20      21      22      23      24
f@fofo.com      20      21      22      23      24

Thanks!

Tags (3)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can either append this to your search:

... | xyseries email error count

Or use chart count over error by email instead of stats count by email error.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can either append this to your search:

... | xyseries email error count

Or use chart count over error by email instead of stats count by email error.

diogofgm
SplunkTrust
SplunkTrust

Try this instead of the last stats command:

| chart count over error by email
------------
Hope I was able to help you. If so, some karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...