topic How do I add a count to a table using the table command? in Splunk Search

How do I add a count to a table using the table command?

Svill321 — Thu, 06 Jul 2017 18:22:37 GMT

How do I add a count to a table using the table command? The project I'm working on requires that a table is mad showing the day of the week, followed by a list of the users who logged on that day and how many time the logged on. The output looks something like this:

=============================================
Wednesday          |                                  user1         |     5
                   |                                  user2         |     3
                   |                                  user3         |     4
                   |                                  user4         |     3
=============================================

I'm currently using this search to get some of what I need:

index=* date=* user=* | transaction date | table date user

But I can't get the count I need at the end. I tried appending a stats count:

index=* date=* user=* | transaction date | table date user | appendcols [search user=* | stats count by user]

But had no luck. Is there anyway to do this?

Re: How do I add a count to a table using the table command?

sbbadri — Thu, 06 Jul 2017 18:41:04 GMT

... | addcoltotals labelfield=change_name label=count

Re: How do I add a count to a table using the table command?

somesoni2 — Thu, 06 Jul 2017 19:02:33 GMT

I would do like this (totally avoiding transaction command), will give the output in expected format.

index=* date=* user=* | stats count by date user | stats list(user) as user list(count) as count by date

Re: How do I add a count to a table using the table command?

Svill321 — Thu, 06 Jul 2017 20:31:38 GMT

You, my friend, are a saint! This works perfectly. Thanks!