topic Re: how do I format the table output as below in Dashboards & Visualizations

how do I format the table output as below

tnguyen125 — Sat, 28 Jul 2018 06:26:28 GMT

index=source a1 OR a2 OR a3 OR a4 OR a5

how do I list the result them as

Application Count
a1 23
a2 54
a3 73
a4 52
a5 56
Total 258

Re: how do I format the table output as below

tnguyen125 — Sat, 28 Jul 2018 06:36:17 GMT

current search that i have below. This search only give me the total events , not categorize by application
index=source a1 OR a2 OR a3 OR a4 OR a5 | timechart span=1d count | sort -_time

Re: how do I format the table output as below

HiroshiSatoh — Sun, 29 Jul 2018 07:48:24 GMT

Try this!

index=source a1 OR a2 OR a3 OR a4 OR a5
|stats count by Application 
|addcoltotals labelfield=Application label=Total count

Re: how do I format the table output as below

adonio — Sun, 29 Jul 2018 16:02:40 GMT

try this:
index=source a1 OR a2 OR a3 OR a4 OR a5 | timechart span=1d count by application

Re: how do I format the table output as below

tnguyen125 — Sun, 29 Jul 2018 23:14:08 GMT

Hi Adorio, it does not work

Re: how do I format the table output as below

tnguyen125 — Sun, 29 Jul 2018 23:19:05 GMT

a1,a2,a3,a4,a5 are the application id's. How do name them as applications ?

Re: how do I format the table output as below

tnguyen125 — Sun, 29 Jul 2018 23:20:08 GMT

a1,a2,a3,a4,a5 are the application id's. How do I name them as applications ?
a1 = app1
a2 = app2
a3 = app3
a4 = app4
a5 = app5

the output will be like this:

app1 23
app2 54
app3 73
app4 52
app5 56
Total 258

Re: how do I format the table output as below

adonio — Sun, 29 Jul 2018 23:45:05 GMT

can you share a sample of your data?

Re: how do I format the table output as below

HiroshiSatoh — Tue, 29 Sep 2020 20:40:35 GMT

I think it would be better to use a lookup table.

ex.)
applications.csv

application_id,application_name
a1,app1
a2,app2
a3,pp3
a4,pp4
a5,app5

index=source a1 OR a2 OR a3 OR a4 OR a5
 |stats count by Application 
 |lookup applications.csv application_id as Application
 |addcoltotals labelfield=Application_name label=Total count
 |fields - Application

※Correct the field name correctly.

Re: how do I format the table output as below

tnguyen125 — Mon, 30 Jul 2018 08:07:20 GMT

Hi HiroshiSatoh, it does not work

Re: how do I format the table output as below

tnguyen125 — Tue, 29 Sep 2020 20:45:22 GMT

index=source 0oamhvpskG93fy30b297 OR amhpp7ohgExCpYDx51478
|stats count by Application
|lookup applications.csv application_id as Application
|addcoltotals labelfield=Application_name label=Total count
|fields - Application

Hello HiroshiSatoh,
My search above returns:
Error in 'lookup' command: Lookups: The lookup table 'applications.csv' does not exist or is not available.
The search job has failed due to an error. You may be able view the job in the Job Inspector.

5.3k ● 5 ● 5 ● 9

Re: how do I format the table output as below

HiroshiSatoh — Tue, 31 Jul 2018 01:00:22 GMT

You should do your own lookup table creation and lookup definition.

http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Aboutlookupsandfieldactions