topic Split a column in the search data into multiple columns in Splunk Search

Split a column in the search data into multiple columns

shiv1593 — Wed, 10 Jan 2018 13:04:52 GMT

Hi All,

I have a file of Tickets to analyse. I want to arrange the data as per the following image. What can I do to achieve the same.

Re: Split a column in the search data into multiple columns

gcusello — Wed, 10 Jan 2018 15:05:52 GMT

Hi shiv1593,
try something like this

your_search
| chart sum(number) AS number OVER region BY priority
| addtotals
| addcoltotals labelfield=region

Bye.
Giuseppe

Re: Split a column in the search data into multiple columns

shiv1593 — Tue, 29 Sep 2020 17:36:26 GMT

Hi Giuseppe,

I tried. It didn't work. I am fairly new to Splunk, can you look at my query with your query added and see whether am I doing something wrong?

Re: Split a column in the search data into multiple columns

gcusello — Wed, 10 Jan 2018 15:32:11 GMT

Hi
the field in sum must be the one in the previous stats (rename for you):

host="service_desk_tickets" Number="*" Region="*" Priority="*" 
| eval Region = upper(Region)
| stats count(Number) AS Number by Region Priority
| chart sum(Number) AS Number OVER Region BY Priority
| addtotals
| addcoltotals labelfield=Region

Only few hints:

when you share a code use Code Sample button (icon 101010), otherwise some char isn't correctly showed,
use always index=index_name because search is quicker,
put rename in stats,
don't use Total as field name because it's the same used in addcoltotals command.

Bye.
Giuseppe

Re: Split a column in the search data into multiple columns

shiv1593 — Wed, 10 Jan 2018 15:42:26 GMT

Thanks a lot, Giuseppe. That was really helpful. I will take into account your tips.