Dashboards & Visualizations

How to transpose 2nd column

james_n
Path Finder

I have query as shown below,

|stats count by stn stn_status

result:

stn stn_state count
stn_1 completed 20
stn_1 In progress 2
stn_1 failed 8
stn_2 completed 30
stn_3 completed 10
stn_3 failed 10

expected results:

Stn completed In progress failed

stn_1 20 2 8
stn_2 30
stn_3 10 10

Help me on this, Thanks in Advance.

Labels (1)
Tags (1)
0 Karma
1 Solution

rmmiller
Contributor

Replace your stats command with this:

| chart count over stn by stn_state

Note: I couldn't tell whether the correct field name is "stn_state" or "stn_status" since you use both in your question. Use the correct field name in this chart command, and you should get the results you want.

Hope that helps!
rmmiller

View solution in original post

woodcock
Esteemed Legend

Simply change stats to chart; no other changes are necessary.

0 Karma

rmmiller
Contributor

Replace your stats command with this:

| chart count over stn by stn_state

Note: I couldn't tell whether the correct field name is "stn_state" or "stn_status" since you use both in your question. Use the correct field name in this chart command, and you should get the results you want.

Hope that helps!
rmmiller

james_n
Path Finder

It Works, Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...