hi,
I had the data in the following format
location product price
location1 Product1 price1
location1 product2 price2
location2 product1 price3
location2 product2 price4
I need to re-align it in following format
location product1 product2
location1 price1 price2
location2 price3 price4
I can do it by splitting column by data model or pivot from base query. but is there any way for the using the SPL the following can be achieved.
Try like this
your current search giving fields location product price
| xyseries location product price
See more about xyseries command here: http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Xyseries
Try like this
your current search giving fields location product price
| xyseries location product price
See more about xyseries command here: http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Xyseries
Try this!
(your search)
|table location product price
|eval {product}=price
|stats sum(product*) as product* by location
The answer of somesoni 2 is good.
your current search giving fields location product price
| xyseries location product price
| stats sum(product*) as product* by location