Which command is the opposite of untable?

The untable command is a transforming command that converts results from a wide, tabular format into a long format. It takes a table with multiple data columns and transforms it into three columns: one for the row label, one for the column (series) label, and one for the value. The xyseries command performs the exact inverse operation. It takes data in a long, three-column format and pivots it into a wide, tabular format suitable for charting, where the values from one column become the new column headers. Therefore, xyseries is the direct opposite of untable.

A. chart: While chart can pivot data, it is a broader aggregation command. xyseries is the specific command designed as the direct inverse of untable.

B. table: The table command is a simple reporting command that selects and orders specified fields for display; it does not restructure or pivot data.

C. bin: The bin command is used to group continuous numerical values into discrete sets. It is used for bucketing data, not for pivoting its structure.

1. Splunk Enterprise Documentation, Search Reference, untable command:

"The untable command is the inverse of the xyseries command. The untable command converts results from a tabular format into a format similar to a statistics table."

Source: Splunk Documentation | Search Manual | untable.

2. Splunk Enterprise Documentation, Search Reference, xyseries command:

"The xyseries command turns search results into a format suitable for charting. The command replaces search results with a table of values, values, and values." This describes the pivoting action that is the reverse of untable.

Source: Splunk Documentation | Search Manual | xyseries.