Answers for "Comparing arbitrary # of columns values similar to xyseries?"
https://answers.splunk.com/answers/685354/comparing-arbitrary-of-columns-values-similar-to-x.html
The latest answers for the question "Comparing arbitrary # of columns values similar to xyseries?"Answer by DalJeanis
https://answers.splunk.com/answering/685514/view.html
You want the `untable` command. It is the inverse of `xyseries`, and gives you exactly the transformation you are asking for.
| untable date licker licked
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Untable
----------
And here's a run-anywhere example
| makeresults
| eval mydata="8/1/2018 RITA=15 HENRY=14 STEFAN=15!!!!8/2/2018 RITA=16 HENRY=14 STEFAN=15!!!!8/3/2018 AMY=16 HENRY=14 STEFAN=15"
| makemv delim="!!!!" mydata
| mvexpand mydata
| eval _time=strptime(substr(mydata,1,8),"%m/%d/%Y")
| eval mydata=substr(mydata,9)
| rex field=mydata max_match=0 "\b(?<onelicker>\S*)\b"
| fields - mydata
| mvexpand onelicker
| rex field=onelicker "(?<StampLicker>[^=]*)=(?<Produced>\d*)$"
| fields - onelicker
| chart sum(Produced) by _time StampLicker
| rename COMMENT as "The above just enters your data as given"
| untable _time StampLicker ProducedThu, 06 Sep 2018 00:48:35 GMTDalJeanis