Splunk Search

Contingency table using dictated column fields

totho
New Member

I am currently looking to make a table that shows how variables from 5 fields (the first five rows that splunk says have the biggest count) end up being spread into 5 new fields. As of now, I have maxcol and maxrow set to 5. I know the 5 new fields that I want to specifically look at. Is there any way to call these fields out when I am doing the search. My current search looks like this

index=name |'data' | contingency group newgroup maxcols=5 maxrows=5 usetotal=false

I was hoping there would be some way to replace the maxcols=5 with a variable like col1=fielda col2=fieldb etc....

0 Karma

woodcock
Esteemed Legend

Like this:

index=name AND newgroup IN("value1", "value2", "value3", "value4", "value5")
| 'data'
| contingency group newgroup maxrows=5 usetotal=false
| table group value1 value2 value3 value4 value5

Here is a run-anywhere example:

index=_* AND sourcetype IN("splunkd", "splunk_resource_usage", "audittrail", "splunkd_access", "kvstore") AND date_minute IN("10", "20", "30", "40", "50")
| contingency sourcetype date_minute
0 Karma

to4kawa
Ultra Champion

Hello
Please provide a sample of the current results and the expected results.

Maybe you can do it with untable

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...