Splunk Search

Contingency table using dictated column fields

totho
New Member

I am currently looking to make a table that shows how variables from 5 fields (the first five rows that splunk says have the biggest count) end up being spread into 5 new fields. As of now, I have maxcol and maxrow set to 5. I know the 5 new fields that I want to specifically look at. Is there any way to call these fields out when I am doing the search. My current search looks like this

index=name |'data' | contingency group newgroup maxcols=5 maxrows=5 usetotal=false

I was hoping there would be some way to replace the maxcols=5 with a variable like col1=fielda col2=fieldb etc....

0 Karma

woodcock
Esteemed Legend

Like this:

index=name AND newgroup IN("value1", "value2", "value3", "value4", "value5")
| 'data'
| contingency group newgroup maxrows=5 usetotal=false
| table group value1 value2 value3 value4 value5

Here is a run-anywhere example:

index=_* AND sourcetype IN("splunkd", "splunk_resource_usage", "audittrail", "splunkd_access", "kvstore") AND date_minute IN("10", "20", "30", "40", "50")
| contingency sourcetype date_minute
0 Karma

to4kawa
Ultra Champion

Hello
Please provide a sample of the current results and the expected results.

Maybe you can do it with untable

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...