Splunk Dev

Getting field and value count in the same format

Atchyuth_P
Path Finder

Hi,

 
I have two values in a field named (Online Booking) and want to display the same in tabular format and I tried eval, stats command but not giving the expected result.
 
Question : Total count to find out the option to book table
 
 
Atchyuth_P_2-1632624367086.png

and the output that i am expecting is

Atchyuth_P_3-1632624396799.png
 

Please let me know which command needs to be used and also reference books for learning development, I am completely new to Splunk

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

For SimpleXML dashboards, add a format block to the table with the useThousandSeparators option

https://docs.splunk.com/Documentation/Splunk/8.2.2/Viz/TableFormatsXML 

 

        <format type="number" field="count">
          <option name="useThousandSeparators">true</option>
        </format>

 

0 Karma

Atchyuth_P
Path Finder

Thank you @ITWhisperer for suggesting the method of using XML .

I have tried with the command (chart count by "Online Booking") gives me the accurate search result and also tried with XML and my dashboard looks quite good.

 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...