topic How to create a table with several fields and totals by each value in Splunk Search

How to create a table with several fields and totals by each value

splunk_exercice — Wed, 22 Jan 2020 00:01:31 GMT

Imagine that I have a table of results like this:

Field1 Field2 Field3 Field4 Field5 Field6 Field7 Field8 Field9
1     0     1    0     0    3     0      0    3 
1     0     3    1     0    1     1      0    0     
2     0     1    0     1    3     0      0    3 
1     0     3    1     0    1     1      0    1 
3     0     2    0     0    3     0      0    3 
1     0     3    1     0    3     0      0    1 
3     1     1    0     0    1     1      0    3 
0     0     3    1     1    2     1      0    1

For each column I want to have the following statistics:
Field1 with 0 Values: 1
Field1 with 1 Values: 4
Field1 with 2 Values: 2
Field1 with 3 Values: 2
Field2 with 0 Values: 8
Field2 with 1 Values: 1
Field2 with 2 Values: 0
Field2 with 3 Values: 0
Field3 with 0 Values: 0
Field3 with 1 Values: 3
Field3 with 2 Values: 1
Field3 with 3 Values: 4
Field4 with 0 Values: 4
Field4 with 1 Values: 4
Field4 with 2 Values: 0
Field4 with 3 Values: 0
...
until Field9.

How can I do this? And it´s possible to adapt to a line chart?

Thanks in advance.

Best Regards.

Re: How to create a table with several fields and totals by each value

to4kawa — Wed, 22 Jan 2020 02:21:48 GMT

| makeresults 
| eval _raw="Field1,Field2,Field3,Field4,Field5,Field6,Field7,Field8,Field9
1,0,1,0,0,3,0,0,3
1,0,3,1,0,1,1,0,0
2,0,1,0,1,3,0,0,3
1,0,3,1,0,1,1,0,1
3,0,2,0,0,3,0,0,3
1,0,3,1,0,3,0,0,1
3,1,1,0,0,1,1,0,3
0,0,3,1,1,2,1,0,1" 
| multikv forceheader=1 
| table Field1,Field2,Field3,Field4,Field5,Field6,Field7,Field8,Field9 
`comment("this is your sample")`
`comment("from here , the logic")`
| eval tmp=1 
| untable tmp field_name value 
| eventstats count(eval(value=0)) as with0 count(eval(value=1)) as with1,
    count(eval(value=2)) as with2 count(eval(value=3)) as with3 by field_name 
| table field_name with* 
`comment("I think above is enough, but as you want, i do")`
| untable field_name with_number value 
| rex field=with_number mode=sed "s/with(\d)/with \1/" 
| eval value = "value: ".value

Hi, @splunk_exercice
How about this?