topic Re: Manipulating a Table in Splunk Search

Manipulating a Table

KarunK — Sun, 14 Sep 2014 23:34:38 GMT

Hi All,

I have a following table. Total is the sum of the cost of items by country using eventstats.

   Country      Items   cost    Total
    US      pen     3       6
    US      pencil  2       6
    US      paper   1       6
    UK      pen     6       12
    UK      pencil  3       12
    UK      paper   3       12
    HK      pen     4       7.5
    HK      pencil  2.5     7.5
    HK      paper   1       7.5

I need to modify the table to look like below.

Country Items   cost    Total
US  pen 3   6
    pencil  2   
    paper   1   
UK  pen 6   12
    pencil  3   
    paper   3   
HK  pen 4   7.5
    pencil  2.5 
    paper   1

I have played around with stats values function but of no use. Any ideas ???

Thanks in Advance.

Re: Manipulating a Table

MuS — Mon, 15 Sep 2014 07:16:49 GMT

Hi KarunK,

take this run everywhere example and adapt it to your needs:

index=_internal sourcetype=splunkd 
| eventstats count AS myCount by series 
| stats list(series) AS series list(myCount) AS count sum(myCount) AS total by sourcetype

This will return something similar to your target.

hope this helps...

cheers, MuS

Re: Manipulating a Table

KarunK — Fri, 19 Sep 2014 03:40:32 GMT

Values wont work as it show only the unique value. I want to show all values.

Thanks for your thoughts !!!

KKN

Re: Manipulating a Table

MuS — Fri, 19 Sep 2014 04:36:18 GMT

Use list instead of values in that case 😉

Re: Manipulating a Table

KarunK — Mon, 22 Sep 2014 05:01:24 GMT

Great !!! Issue resolved....
Thanks Mate ...

Re: Manipulating a Table

MuS — Mon, 22 Sep 2014 05:22:41 GMT

please mark this as answered, thx