Splunk Search

how to transpose rows into multiple columns based on grouping?

trkalva
Engager

Hi,

I have a query which fetches me the below result in a table:

Thread | Total_Run_Time

READER_1_1_1 303.971798

READER_1_1_1 151.724136

READER_1_2_1 303.97251

READER_1_2_1 151.728481

TRANSF_1_1_1 310.477318

TRANSF_1_1_1 157.788452

TRANSF_1_2_1 310.480424

TRANSF_1_2_1 157.791372

WRITER_1_*_1 310.985073

WRITER_1_*_1 159.198983

I want all the distinct values(number is dynamic) under 'Thread' as columns with corresponding values from Total_Run_Time

I need the result like this:

READER_1_1_1_Total_Run_Time | READER_1_2_1_Total_Run_Time | TRANSF_1_1_1_Total_Run_Time | TRANSF_1_2_1_Total_Run_Time | WRITER_1_*_1_Total_Run_Time

303.971798 303.97251 310.477318 310.480424 310.985073

151.724136 151.728481 157.788452 157.791372 159.198983


Edit based on the suggestion:


The query suggested by asimagu "| chart list(Total_Run_Time) over date_hour by Thread" gave the below result:

date_hour READER_1_1_1 READER_1_2_1 TRANSF_1_1_1 TRANSF_\1_\2_1 WRITER_\1_*_\1


17 (303.971798 151.724136) (303.97251 151.728481) (310.477318 157.788452) (310.480424 157.791372) (310.985073 159.198983)

How to make a line chart of true values of these fields by columns (like READER_1_1_1 with 303.971798, 151.724136) as these are multivalue fields?

please suggest

Tags (3)
0 Karma
1 Solution

asimagu
Builder

have a play with

chart over by

that should do the magic, I don't know what your search looks like but maybe play putting your field names in one or other position in the command I just gave you

View solution in original post

asimagu
Builder

have a play with

chart over by

that should do the magic, I don't know what your search looks like but maybe play putting your field names in one or other position in the command I just gave you

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...