topic Re: Creating a table with multiple fields in Splunk Search

How to create a table with multiple fields?

suvi6789 — Tue, 05 Sep 2023 19:08:44 GMT

Hi,

I want to create a table in the below format and provide the count for them.
I have multiple fields in my index and I want to create a table(similar to a excel pivot) using three fields

App Name, Response code and Method

index=abcd
| chart count over App Name by Response code

--> Above works for me but I can create a table only using 2 fields.
How to create a table something as below format with 3 fields or more than 3.

Please could you help.

APP NAME	RESPONSECODE	RESPONSECODE	RESPONSECODE
200	400	400
GET	POST	PATCH	GET	POST	PATCH	GET	POST	PATCH
APP1
APP2
APP3
APP4
APP5
APP6

Re: Creating a table with multiple fields

suvi6789 — Mon, 04 Sep 2023 18:13:27 GMT

The table pasted has been reformated. I have attached the image of the format that I need.
Please check the attached image

Re: Creating a table with multiple fields

bowesmana — Mon, 04 Sep 2023 23:07:22 GMT

I am assuming that you want to get 200, 400 and 500 (not a second 400) response codes.

You can combine the response code and method and then chart by that field, e.g. see this run anywhere example but it is the last two lines you want.

| makeresults count=40 | eval responseCode=mvindex(split("200,400,500", ","), random() % 3) | eval method=mvindex(split("GET,POST,PATCH", ","), random() % 3) | eval app="APP".(random() % 5) ``` Use these two lines to get the chart you want ``` | eval s=responseCode."_".method | chart count over app by s

It will not give you a multiline header as in your image, but that's not really how Splunk does things in tables.

Re: Creating a table with multiple fields

suvi6789 — Fri, 08 Sep 2023 10:17:35 GMT

Hi,
Many thanks for the update. This is helpful.
I will consider this as a solution