topic Re: how to make table in splunk in Splunk Search

How to make table in Splunk

logloganathan — Mon, 18 Apr 2022 14:35:49 GMT

Please provide different examples so that its very easy for us to understand.
explaining the example with eval command will be awarded.

Re: how to make table in splunk

mayurr98 — Thu, 15 Mar 2018 10:44:19 GMT

Generate a table
To generate a table, write a search that includes a transforming command. From the Search page, run the search and select the Statistics tab to view and format the table.

You can use the table command in a search to specify the fields that the table includes or to change table column order.

Search examples
1) Transforming search
This search uses the chart transforming command.

index = _internal | chart avg(bytes) over sourcetype

2) Transforming search with the table command
This search generates a table with action, host, and count columns.

index = _internal | stats count by action, host

To change the columns that appear in the table or to change column order, add the table command to this search. For example, add | table host count to generate a table with only the host and count columns.

index = _internal | stats count by action, host | table host count

3) Using eval

| makeresults 
  | eval field_a ="My Value A", field_b ="Other Value B" 
  | table [|makeresults |  eval search ="field_a field_b" | table search ]

Also, have a look at this table command reference doc there are many examples in this
https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Table

let me know if this helps!

Re: how to make table in splunk

logloganathan — Thu, 15 Mar 2018 11:21:11 GMT

thanks for your answer

Re: how to make table in splunk

Taruchit — Mon, 18 Apr 2022 10:32:01 GMT

Hello All,

Can you please help to make following type of tables using | makeresults command: -

Column1	Column2
C1	A,B,C
C2	D,E,F,G
C3	X

Column1	Column2
C1	A
C1	B
C1	C
C2	D
C2	E
C2	F
C2	G
C3	X

Thank you

Re: how to make table in splunk

vinod743374 — Tue, 19 Apr 2022 12:09:44 GMT

Re: how to make table in splunk

Taruchit — Wed, 27 Apr 2022 15:57:07 GMT

Thank you, it worked successfully.