topic Re: How to create a table? in Splunk Search

How to create a table?

ko1 — Thu, 01 Jun 2023 08:58:47 GMT

Can we aggregate the data in the specified column?

example SPL A)
index=pan_logs | stats count by signature,src,dest

example SPL A Result)

Want to creat table)

We want to aggregate by signature_name without changing src<->dest combination.

gcusello — Thu, 01 Jun 2023 09:05:13 GMT

it's not possible to display results in the format you want, Splunk isn't Excel!

but you can do something like this:

index=pan_logs | eval col="src=".src." dest=".dest | stats values(col) AS "src dest" count BY signature

Ciao.

Giuseppe

ITWhisperer — Thu, 01 Jun 2023 09:23:58 GMT

| stats list(src) as src list(dest) as dest sum(count) as count by signature_name

ko1 — Thu, 01 Jun 2023 23:52:24 GMT

Hi, @gcusello .
I will use this.
Thanks a lot!

gcusello — Fri, 02 Jun 2023 06:53:19 GMT

Hi @ko1 ,

if one answer solves your need, please accept this one for the other people of Community or tell us how we can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors;-)