hello,
i have a log like this:
time,type,field1,field3,field3,field4,field5,......
0102,A,2,3,4,1,3,...
0102,B,2,2,4,1,3,...
i want to show the result like below.
A B
field1_name 2 2
field2_name 3 2
field3_name 4 4
..........
I tried to use apend, but the search is too long.
... type="A" | eval name="field1_name" | stats values(field1) as ta,values(name) as name | append [search ... type="A" | eval name="field2_name" | stats values(field2) as ta,values(name) as name ]| append [search ... type="A" | eval name="field3_name" | stats values(field3) as ta,values(name) as name ]| append [search ... type="B" | eval name="field1_name" | stats values(field1) as tb,values(name) as name | append [search ... type="B" | eval name="field2_name" | stats values(field2) as tb,values(name) as name ]| append [search ... type="B" | eval name="field3_name" | stats values(field3) as tb,values(name) as name ]| stats values(ta) as A,values(tb) as B by name
I'm looking to see if there more streamlined command.
Thanks a lot.
transpose other fields and rename columns as A,B .
for example
your search |table field1_name field2_name |transpose |rename row1 as A etc...
hi smolcj
thank you a lot!
But there is a small problem.
the result will like below.
column row 1 row 2
tpye A B
field1_name 2 2
field2_name 3 2
....
I want the first line to hide
It's possible to reach it?
Thanks a lot again.
great!!! happy splunking flora
It seems I think too much.
...|search cloumn!="type"
Thank you very much!!!!
you should extract the fields separately and display all the fields except the type field and try transposing the result.. i mean avoid type field in table ..
transpose other fields and rename columns as A,B .
for example
your search |table field1_name field2_name |transpose |rename row1 as A etc...