Splunk Search

Transpose table columns and rows with stats

hbakker
Engager

Problem Statement: I have a query that outputs performance percentile statistics by operation methods. Example: |chart p50(duration), p75(duration) by method.

I want to be able to create a column chart so all the percentile results are stacked, meaning p50s stacked with P50s, P75s stacked with P75s). The problem is that my query returns the methods on the left as rows and the percentile as the column headings, so when chart it is stacking the values of the methods versus stacking the percentiles.

I tried using transpose, but that doesn't seem to work, because it gives me row 1, row2, etc and I cannot rename because the list of methods is dynamic. Thoughts?

Tags (1)
0 Karma

lguinn2
Legend
yoursearchhere
| stats p75(duration) as p75 p50(duration) as p50  by method

Yes, it is stats, not chart. But click into the "Results Chart" view. Then choose how you want the results displayed.

This solution leverages the fact that the rows and columns are named differently for stats.

HTH

0 Karma

hbakker
Engager

Thanks for the quick response. I switched to using stats. Without using transpose it is still giving me the same issue. And when I used transpose while it helped that the columns are named correct, the rows (methods) are still labelled row1, row2, row3 rather than the method labels. What am I missing?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...