Splunk Search

How can I create this report table with two column labels?

Laya123
Communicator

Hi,

Is it possible to get a report like this in Splunk?

I have fields APP, status and category. Here I am taking the count of status for each category by APP. I want a category for each row, and under each APP, I want the status and total of each column with a Grand Total column on the far right side of the table. Please refer to the attached image sample.png as the table was too wide for proper formatting on this site.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this (you will need to adjust some things to match your search/data and may need to re-order the fields):

YourBaseSearchHere APP="N-S" | eval app_status = APP . ":" . status | chart count over Cat by app_status | addtotals | rename Total AS "N-S Total" | appendcols [ YourBaseSearchHere APP="S-V" | eval app_status = APP . ":" . status | chart count over Cat by app_status | addtotals | rename Total AS "S-V Total" ]  | eval Grand_Total=0 | foreach *Total [ eval Grand_Total = Grand_Total + $<<FIELD>>$ ] | addcoltotals labelfield=Cat label=Total

View solution in original post

woodcock
Esteemed Legend

Like this (you will need to adjust some things to match your search/data and may need to re-order the fields):

YourBaseSearchHere APP="N-S" | eval app_status = APP . ":" . status | chart count over Cat by app_status | addtotals | rename Total AS "N-S Total" | appendcols [ YourBaseSearchHere APP="S-V" | eval app_status = APP . ":" . status | chart count over Cat by app_status | addtotals | rename Total AS "S-V Total" ]  | eval Grand_Total=0 | foreach *Total [ eval Grand_Total = Grand_Total + $<<FIELD>>$ ] | addcoltotals labelfield=Cat label=Total

Laya123
Communicator

Thank you so much, its working.

But one small thing. Is it possible to put N-S Total after app_status of N-S and S-V Total after app_Status of S-V Total and Grandtotal in last column
Thanks in advance

0 Karma

woodcock
Esteemed Legend

I do not understand why Splunk is reordering the fields but you can manually reorder them with the fields command by specifying every field in the order that you desire.

0 Karma

Laya123
Communicator

Thank you

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...