After linking the data, when I go to the search string, it shows the events and all the details from tags, but does not show me any statistics. Because of this, I need to create the pivot table manually for report design. I guess I am wrong somewhere in creating logic in the data model from where I am taking the information. Can anyone please tell me what is the standard procedure so the I will get the statistics also after search string query. if you provide me any sample case study it will be highly appreciable.
Hi vkale
look at an example of search using pivot command
example : Using the Tutorial data model, create a pivot table for the count of
"HTTP Requests" per host.
| pivot Tutorial HTTP_requests count(HTTP_requests) AS "Count" SPLITROW
host AS "Server" SORT 100 host
For more information see the manuel Splunk-6.2.2-PivotTutorial.pdf