topic How to make a table with 3 datas in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-3-datas/m-p/446597#M126684 <P>Each day i execute my search <BR /> This search give me the number of events with status OK or KO by enterprise</P> <P>nameEnterprise OK KO<BR /> Enterprise1 4 0<BR /><BR /> Enterprise2 76 0<BR /><BR /> Enterprise3 4 0 </P> <P>I'd like to see in my dashboard the result of my search for severals days</P> <PRE><CODE> day1 day2 day3 OK KO OK KO OK KO </CODE></PRE> <P>Enterprise1 4 0 83 3 1 0 <BR /> Enterprise2 76 0 5 1 5 0 <BR /> Enterprise3 4 1 15 0 12 2 </P> <P>Is it possible ?</P> <P>sorry for the presentation of tables</P> Thu, 14 Jun 2018 09:24:17 GMT faribole 2018-06-14T09:24:17Z How to make a table with 3 datas https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-3-datas/m-p/446597#M126684 <P>Each day i execute my search <BR /> This search give me the number of events with status OK or KO by enterprise</P> <P>nameEnterprise OK KO<BR /> Enterprise1 4 0<BR /><BR /> Enterprise2 76 0<BR /><BR /> Enterprise3 4 0 </P> <P>I'd like to see in my dashboard the result of my search for severals days</P> <PRE><CODE> day1 day2 day3 OK KO OK KO OK KO </CODE></PRE> <P>Enterprise1 4 0 83 3 1 0 <BR /> Enterprise2 76 0 5 1 5 0 <BR /> Enterprise3 4 1 15 0 12 2 </P> <P>Is it possible ?</P> <P>sorry for the presentation of tables</P> Thu, 14 Jun 2018 09:24:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-3-datas/m-p/446597#M126684 faribole 2018-06-14T09:24:17Z Re: How to make a table with 3 datas https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-3-datas/m-p/446598#M126685 <P>The question is not clear,but as per my understanding you need to plot a table with enterprisename status and Days,you can use chart command for this:</P> <P>your search |chart status OVER Days BY enterprisename</P> Thu, 14 Jun 2018 09:42:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-3-datas/m-p/446598#M126685 ansif 2018-06-14T09:42:23Z Re: How to make a table with 3 datas https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-3-datas/m-p/446599#M126686 <P>What i want to do</P> <P>Before<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5166iAB7FAA59D2DDC692/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>After<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5167iD3AB930789EB7C94/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 14 Jun 2018 11:57:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-3-datas/m-p/446599#M126686 faribole 2018-06-14T11:57:54Z Re: How to make a table with 3 datas https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-3-datas/m-p/446600#M126687 <P>Splunk doesn't support two-level columns or merged cells. You can however have the columns like <CODE>Date1: KO, Date1: OK</CODE> . If you would've shared you search, we could provide better answer, but it'll something like this</P> <PRE><CODE>your base search | eval DayStatus=strftime(_time,"%F").":".Status | chart count over nameEnterprise by DayStatus </CODE></PRE> Thu, 14 Jun 2018 14:54:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-table-with-3-datas/m-p/446600#M126687 somesoni2 2018-06-14T14:54:15Z