Splunk Search

Field results as table column headings

Champion

A quick example;

Program Name    2.04.0  2.4.3   3.4.24  4.53.5  9
Word            2       1       0       1
Excel           1       2       2       1   
IE              0       0       0       0       1
ETC

The above example was something I produced completely by accident when experimenting with searches to solve a different problem, looking back now I realise that I can actually use this.
What I have done is performed a search on two fields, programname and programversion. With the resultant data I have managed to construct a table where the version fields found form the headings for each column.
The program name forms each row with a count of how many occurrences of that program name which has the corresponding program version.
Firstly I did try going back through the history but this didn't produce anything of use and I have been since experimenting endlessly with different combinations of stats commands to try and re-produce - any pointers/nudges or help would be appreciated.

1 Solution

Legend

The chart command could be used to be achieve this. By giving chart two fields to split the results by, it will output a table like the one you show in your question where the columns are made up from the distinct values of the first field, and the rows are correspondingly made up from the distinct values of the second field. So, using the field names program_name and program_version this will give you the table you want:

<yourbasesearch> | chart count by program_name,program_version

View solution in original post

Legend

The chart command could be used to be achieve this. By giving chart two fields to split the results by, it will output a table like the one you show in your question where the columns are made up from the distinct values of the first field, and the rows are correspondingly made up from the distinct values of the second field. So, using the field names program_name and program_version this will give you the table you want:

<yourbasesearch> | chart count by program_name,program_version

View solution in original post