topic Re: Query results with field values as column header in Splunk Search

Query results with field values as column header

ma_anand1984 — Mon, 28 Sep 2020 12:57:42 GMT

I have following fields
Datacenter, Category(Cat ), Application(APP), Description(Desc).

Datacenter has 10 or more possible values.

Now i want a table like below

First line is header where Datacenter_value1 .... Datacenter_valueN are values of field Datacenter and Count is sum of counts of each Datacenter_value column

Count Datacenter_value1 Datacenter_value2 ..... Datacenter_valueN Cat APP Desc



450     5               23            .....   37      error cycle  frame error


565    16               43            .....   56      info  car    engine ready

Re: Query results with field values as column header

jonuwz — Thu, 13 Dec 2012 11:40:19 GMT

Given that you rename the 'Category(Cat)' and other fields to 'Cat' 'APP' and 'Desc' up front

Join the "key" fields together first, like this :

... | eval joined_fields=Cat.";".APP.";".Desc

Then chart

... | chart count over joined_fields by Datacenter

Then add your totals

... | addtotals

Then split up the joined fields again

... | rex field=joined_fields "(?<Cat>.*?);(?<APP>.*?);(?<Desc>.*)"

Finally remove the joined_fields from the output

... | fields - joined_fields