how do I format the table output as below

[tnguyen125]

index=source a1 OR a2 OR a3 OR a4 OR a5

how do I list the result them as

Application Count
a1 23
a2 54
a3 73
a4 52
a5 56
Total 258

[HiroshiSatoh]

I think it would be better to use a lookup table.

ex.)
applications.csv

application_id,application_name
a1,app1
a2,app2
a3,pp3
a4,pp4
a5,app5

index=source a1 OR a2 OR a3 OR a4 OR a5
 |stats count by Application 
 |lookup applications.csv application_id as Application
 |addcoltotals labelfield=Application_name label=Total count
 |fields - Application 

※Correct the field name correctly.

[tnguyen125]

index=source 0oamhvpskG93fy30b297 OR amhpp7ohgExCpYDx51478
|stats count by Application
|lookup applications.csv application_id as Application
|addcoltotals labelfield=Application_name label=Total count
|fields - Application

Hello HiroshiSatoh,
My search above returns:
Error in 'lookup' command: Lookups: The lookup table 'applications.csv' does not exist or is not available.
The search job has failed due to an error. You may be able view the job in the Job Inspector.

5.3k ● 5 ● 5 ● 9

5.3k ● 5 ● 5 ● 9

[HiroshiSatoh]

You should do your own lookup table creation and lookup definition.

http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Aboutlookupsandfieldactions

[tnguyen125]

Hi HiroshiSatoh, it does not work

[HiroshiSatoh]

Try this!

index=source a1 OR a2 OR a3 OR a4 OR a5
|stats count by Application 
|addcoltotals labelfield=Application label=Total count

[tnguyen125]

a1,a2,a3,a4,a5 are the application id's. How do I name them as applications ?
a1 = app1
a2 = app2
a3 = app3
a4 = app4
a5 = app5

the output will be like this:

app1 23
app2 54
app3 73
app4 52
app5 56
Total 258

[tnguyen125]

current search that i have below. This search only give me the total events , not categorize by application
index=source a1 OR a2 OR a3 OR a4 OR a5 | timechart span=1d count | sort -_time

[tnguyen125]

a1,a2,a3,a4,a5 are the application id's. How do name them as applications ?

[adonio]

can you share a sample of your data?

[adonio]

try this:
index=source a1 OR a2 OR a3 OR a4 OR a5 | timechart span=1d count by application

[tnguyen125]

Hi Adorio, it does not work