topic Re: help to display fields in a table in Splunk Search

help to display fields in a table

jip31 — Mon, 17 Feb 2020 13:01:35 GMT

HI
I use the search below in order to count errors by Product and source
TOTO
(Source="Hang" OR Source="Error")
| search Product=*
| stats count as count by Product Source

But what I need is to display the colum like this :
Product Hang Errors count
I have tested with transpose but it doenst works
thanks for your help

Re: help to display fields in a table

HiroshiSatoh — Mon, 17 Feb 2020 14:13:09 GMT

How's this?

(Source="Hang" OR Source="Error")
| search Product=*
| stats count(eval(Source="Hang")) as Hang,count(eval(Source="Error")) as Error,count  by Product

Re: help to display fields in a table

jip31 — Mon, 17 Feb 2020 15:50:05 GMT

It seems to be ok thanks

Re: help to display fields in a table

manjunathmeti — Mon, 17 Feb 2020 15:59:11 GMT

[updated]: Are you looking for something like this? If you also need total count.

Product      Hang       Errors     count
x              5          10         15
y              2           0          2

If yes, then you can use xyseries:

(Source="Hang" OR Source="Error") Product=*
| stats count by Product Source
| xyseries Product Source count
| fillnull value="0"
| eval count = Hang + Error