Generate a table
To generate a table, write a search that includes a transforming command. From the Search page, run the search and select the Statistics tab to view and format the table.
You can use the table command in a search to specify the fields that the table includes or to change table column order.
1) Transforming search
This search uses the chart transforming command.
index = _internal | chart avg(bytes) over sourcetype
2) Transforming search with the table command
This search generates a table with action, host, and count columns.
index = _internal | stats count by action, host
To change the columns that appear in the table or to change column order, add the table command to this search. For example, add | table host count to generate a table with only the host and count columns.
index = _internal | stats count by action, host | table host count