topic Re: How can I create this report table with two column labels? in Splunk Search

How can I create this report table with two column labels?

Laya123 — Wed, 12 Aug 2015 11:29:04 GMT

Hi,

Is it possible to get a report like this in Splunk?

I have fields APP, status and category. Here I am taking the count of status for each category by APP. I want a category for each row, and under each APP, I want the status and total of each column with a Grand Total column on the far right side of the table. Please refer to the attached image sample.png as the table was too wide for proper formatting on this site.

Re: How can I create this report table with two column labels?

woodcock — Wed, 12 Aug 2015 22:11:45 GMT

Like this (you will need to adjust some things to match your search/data and may need to re-order the fields):

YourBaseSearchHere APP="N-S" | eval app_status = APP . ":" . status | chart count over Cat by app_status | addtotals | rename Total AS "N-S Total" | appendcols [ YourBaseSearchHere APP="S-V" | eval app_status = APP . ":" . status | chart count over Cat by app_status | addtotals | rename Total AS "S-V Total" ]  | eval Grand_Total=0 | foreach *Total [ eval Grand_Total = Grand_Total + $<<FIELD>>$ ] | addcoltotals labelfield=Cat label=Total

Re: How can I create this report table with two column labels?

Laya123 — Tue, 29 Sep 2020 06:58:06 GMT

Thank you so much, its working.

But one small thing. Is it possible to put N-S Total after app_status of N-S and S-V Total after app_Status of S-V Total and Grandtotal in last column
Thanks in advance

Re: How can I create this report table with two column labels?

woodcock — Thu, 13 Aug 2015 16:19:13 GMT

I do not understand why Splunk is reordering the fields but you can manually reorder them with the fields command by specifying every field in the order that you desire.

Re: How can I create this report table with two column labels?

Laya123 — Mon, 17 Aug 2015 08:56:03 GMT

Thank you