topic Re: How to display the values in search result as fields? in Splunk Search

How to display the values in search result as fields?

cycheng — Thu, 30 May 2013 03:36:33 GMT

I have a search which return below results:

status      total_user
passed      7
failed      3
unknown     14

How can I change the table so that it can display like this:

passed     failed    unknown    total
  7          3         14         24

I tried this but it is not working:
stats values(eval(status="passed")) AS passed values(eval(status="failed")) AS failed values(eval(status="unknown")) AS unknown sum(total_user) AS Total

Re: How to display the values in search result as fields?

Gilberto_Castil — Thu, 30 May 2013 04:02:23 GMT

Add this at the end of your original search string. I will format the data in the desired format.

... | eval dummy=" " | xyseries dummy status total_user | fields - dummy | addtotals

I hope this helps.

Re: How to display the values in search result as fields?

cycheng — Thu, 30 May 2013 04:58:02 GMT

Thanks! It solved my problem. 🙂

Re: How to display the values in search result as fields?

woodcock — Sat, 16 Nov 2019 00:58:20 GMT

Then you should come back and click Accept to close the question, @cycheng.