https://community.splunk.com/t5/Splunk-Search/How-to-create-mutiple-columns-for-a-single-field/m-p/26348#M177647 <P>I have to make dashboard like different age limits as column heading <BR /> eg. </P> <PRE><CODE>product (age)20-25 (age)30 -35 product1 200 300 product2 500 600 </CODE></PRE> <P>How to do this in splunk ?</P> Tue, 07 May 2013 13:55:06 GMT sumanth_isac 2013-05-07T13:55:06Z https://community.splunk.com/t5/Splunk-Search/How-to-create-mutiple-columns-for-a-single-field/m-p/26348#M177647 <P>I have to make dashboard like different age limits as column heading <BR /> eg. </P> <PRE><CODE>product (age)20-25 (age)30 -35 product1 200 300 product2 500 600 </CODE></PRE> <P>How to do this in splunk ?</P> Tue, 07 May 2013 13:55:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-mutiple-columns-for-a-single-field/m-p/26348#M177647 sumanth_isac 2013-05-07T13:55:06Z https://community.splunk.com/t5/Splunk-Search/How-to-create-mutiple-columns-for-a-single-field/m-p/26349#M177648 <PRE><CODE>| eval age_dist=floor(age/5) </CODE></PRE> <P>This will give you a field named age_dist with distinct values for every 5 values of age</P> <PRE><CODE>| eval age_range=case(age_dist==0,"(age)0-4",age_dist==1,"(age)5-9",...,age_dist==n,"(age)n*5-n*5+4") </CODE></PRE> <P>This will give you the age groupings you are looking for</P> <PRE><CODE>| stats count by product age_range </CODE></PRE> <P>This will give you the table you are looking for</P> <P>Your final search should look like:</P> <PRE><CODE>... | eval age_dist=floor(age/5) | eval age_range=case(age_dist==0,"(age)0-4",age_dist==1,"(age)5-9",...,age_dist==n,"(age)n*5-n*5+4") | stats count by product age_range </CODE></PRE> <P>Hope this helps</P> Tue, 07 May 2013 15:24:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-mutiple-columns-for-a-single-field/m-p/26349#M177648 aholzer 2013-05-07T15:24:31Z https://community.splunk.com/t5/Splunk-Search/How-to-create-mutiple-columns-for-a-single-field/m-p/26350#M177649 <P>Alternatively, if you don't need highly customized date ranges, you can use the bucket command before charting.</P> <PRE><CODE>... | bucket age span=5 | stats count by product,age </CODE></PRE> Tue, 07 May 2013 18:00:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-mutiple-columns-for-a-single-field/m-p/26350#M177649 ytamura 2013-05-07T18:00:40Z https://community.splunk.com/t5/Splunk-Search/How-to-create-mutiple-columns-for-a-single-field/m-p/26351#M177650 <P>Thank you, got it now i want to include a $ sign for the values below (age)20-25</P> <P>product (age)20-25 (age)30 -35<BR /> product1 $200 $300<BR /> product2 $500 $600</P> <P>How to do this as this table will be dynamic</P> Wed, 08 May 2013 06:17:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-mutiple-columns-for-a-single-field/m-p/26351#M177650 sumanth_isac 2013-05-08T06:17:18Z https://community.splunk.com/t5/Splunk-Search/How-to-create-mutiple-columns-for-a-single-field/m-p/26352#M177651 <P>Hi, for adding $ you use eval again:<BR /> eval age="$"+age</P> <P>Replace age with your actual field names</P> Wed, 08 May 2013 09:50:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-mutiple-columns-for-a-single-field/m-p/26352#M177651 vj8210 2013-05-08T09:50:03Z https://community.splunk.com/t5/Splunk-Search/How-to-create-mutiple-columns-for-a-single-field/m-p/26353#M177652 <P>There is no Actual field name VJ8210 there are dynamic field name is coming so we are not able to do that.</P> <P>Can you tell me how to add $ to dynamic field name.</P> Wed, 08 May 2013 10:57:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-mutiple-columns-for-a-single-field/m-p/26353#M177652 gajananh999 2013-05-08T10:57:45Z https://community.splunk.com/t5/Splunk-Search/How-to-create-mutiple-columns-for-a-single-field/m-p/26354#M177653 <P>See if the fieldformat command can help you: <A href="http://splunk-base.splunk.com/answers/35124/format-result-set-numbers">http://splunk-base.splunk.com/answers/35124/format-result-set-numbers</A></P> Wed, 08 May 2013 16:30:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-mutiple-columns-for-a-single-field/m-p/26354#M177653 ytamura 2013-05-08T16:30:35Z