Hello all,
I currently have a search that produces the following output:
This is the result of multiple append and join columns.
I would like to transpose the table to this:
I've tried to use | transpose
, but I simply couldn't get it to appear the way I want it. The whole data for Level 1 disappears.
Can anybody please point me in the right direction?
try this
|eval {_time}=performance|fields - time,- performance|stats values(20*) by critname|rename values(* as ""* , *) as *""
you can also refer to my eaelier answer here on something similar if this does not give you the exact output - https://answers.splunk.com/answers/769617/how-to-extract-values-from-field-and-use-it-as-col.html#an...
Hi dojiepreji,
did yu checked the possibility to use chart command?
something like this
| index=my_index
| bin span=1y _time
| chart count over critName BY _time
Ciao.
Giuseppe
try this
|eval {_time}=performance|fields - time,- performance|stats values(20*) by critname|rename values(* as ""* , *) as *""
you can also refer to my eaelier answer here on something similar if this does not give you the exact output - https://answers.splunk.com/answers/769617/how-to-extract-values-from-field-and-use-it-as-col.html#an...