Dashboards & Visualizations

Creating a custom column in pivot table

ringbbg
Engager

HI All. I am trying to create a pivot table to display events happening in our network realtime.
On the Y axis, (Split Columns View), I want to add a field or data that count how many times has that particular event has happened in the set time frame, i.e. 24 hours. right now, since i am unable to do it, i just specied the column axis as "source" -> "list distinct values". just so I do not have an empty column. Can anyone help on how to do that? Thanks

| pivot Test2 Network_mon values(source) AS "Log Directory" SPLITROW _time AS _time PERIOD second SPLITROW host AS host SPLITROW ip AS "peer IP" SPLITROW process AS process SPLITROW syslog_message AS syslog_message | sort 0 -_time

Tags (1)
0 Karma

rjthibod
Champion

How about this?

| pivot Test2 Network_mon count(Network_mon) as count SPLITROW _time AS _time PERIOD second SPLITROW host AS host SPLITROW ip AS "peer IP" SPLITROW process AS process SPLITROW syslog_message AS syslog_message | sort 0 -_time
0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...