topic Re: How to create a table that indicates a column with the sourcetype? in Splunk Search

How to create a table that indicates a column with the sourcetype?

greentomatoes — Mon, 10 Apr 2023 17:29:20 GMT

Hi everyone,

I am currently trying to create a table that shows the count of activity by user as well as the occurrence in which sourcetype:

What I am trying to achieve

Users	Sourcetype	Count
User 1	source 1	20
User 2	source 2	30

Here is my base search at the moment:

index=index* "user"="user1*" OR "user"="user2*" | stats count by user | eval input_type="Count"| xyseries input_type count

Right now, it does show me the count of the user activity but I'm not sure how to add the sourcetype to the search to create a table view.

Re: How to create a table that indicates a column with the sourcetype?

richgalloway — Mon, 10 Apr 2023 17:31:49 GMT

Just add "sourcetype" to the stats command.

index=index* "user"="user1*" OR "user"="user2*" | stats count by user, sourcetype

Re: How to create a table that indicates a column with the sourcetype?

greentomatoes — Mon, 10 Apr 2023 17:38:14 GMT

Thank you! I didn't realize how simple the solution was haha