https://community.splunk.com/t5/Splunk-Search/how-to-create-table-for-multiple-data/m-p/171236#M49033 <P>thank you yannK,<BR /> but i still cant get the things that i want =(</P> <P>my data should display something like this</P> <PRE><CODE> subArea1 subArea2 subArea3... </CODE></PRE> <P>workweek1 12 32 88<BR /> workweek2 96 45 12<BR /> workweek3 23 78 43<BR /> workweek4 37 79 98</P> Wed, 05 Mar 2014 02:59:26 GMT jasklee 2014-03-05T02:59:26Z https://community.splunk.com/t5/Splunk-Search/how-to-create-table-for-multiple-data/m-p/171234#M49031 <P>I need to create a table which will display</P> <P>workweek as rows</P> <P>and subarea as column, meanwhile the data inside will display the passing percentage for each subarea for every workweek.</P> <P>i tried</P> <PRE><CODE>*|stats count(eval(status="Failed")) AS fail,count(eval(status="Passed")) AS pass by workweek|eval passPercentage=if(pass+fail== 0, "-",round(pass/(pass+fail)*100,2))|fields workweek,passPercentage </CODE></PRE> <P>This will only calculate for overall passPercentage for each workweek, but i want it to be done with each subarea of each workweek...</P> Mon, 03 Mar 2014 07:03:25 GMT https://community.splunk.com/t5/Splunk-Search/how-to-create-table-for-multiple-data/m-p/171234#M49031 jasklee 2014-03-03T07:03:25Z https://community.splunk.com/t5/Splunk-Search/how-to-create-table-for-multiple-data/m-p/171235#M49032 <P>what about creating a field for your subarea and use it as a new by condition ?</P> <P><CODE>*<BR /> | eval subarea=case(status="Passed","pass",status="Failed","fail",1=1,"other")<BR /> |chart count over workweek by subarea<BR /> | eval total=pass+fail<BR /> |eval passPercentage=if(total== 0, "-",round(pass/(total)*100,2))<BR /> |fields workweek,passPercentage<BR /> </CODE></P> Wed, 05 Mar 2014 00:36:19 GMT https://community.splunk.com/t5/Splunk-Search/how-to-create-table-for-multiple-data/m-p/171235#M49032 yannK 2014-03-05T00:36:19Z https://community.splunk.com/t5/Splunk-Search/how-to-create-table-for-multiple-data/m-p/171236#M49033 <P>thank you yannK,<BR /> but i still cant get the things that i want =(</P> <P>my data should display something like this</P> <PRE><CODE> subArea1 subArea2 subArea3... </CODE></PRE> <P>workweek1 12 32 88<BR /> workweek2 96 45 12<BR /> workweek3 23 78 43<BR /> workweek4 37 79 98</P> Wed, 05 Mar 2014 02:59:26 GMT https://community.splunk.com/t5/Splunk-Search/how-to-create-table-for-multiple-data/m-p/171236#M49033 jasklee 2014-03-05T02:59:26Z