Splunk Search

How can I get a statistics table comparing discovered assets over time ?

Ombessam
Path Finder

Hello Guys,

I'm trying to get the following table:Screenshot 2025-04-07 at 16.46.43.png

I have the following fields in my index: ip, mac, lastdetect (timestamp) and user_id.

Below is what I have tried so far:

Screenshot 2025-04-07 at 16.57.35.png

When I transpose I get the following:

Screenshot 2025-04-07 at 17.01.50.png

I'm a bit stuck. Can anyone help me achieve my goal (getting a table similar to the first table just above) ? Thanks 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Have you tried using addtotals?

View solution in original post

Ombessam
Path Finder

Thanks @ITWhisperer  for your quick answer addtotals will give the total of the 3 columns for each row while in this case only the total of last two columns are needed. Any workaround ?

Besides, transposing adds a new row in the top while I want the second row to be the first one (header) of the table. Any idea ? thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use addtotals, the eval to subtract the first column?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have you tried using addtotals?

Ombessam
Path Finder

Thanks @ITWhisperer  I've used addtotals. Just one more thing left now how can I transform last  row Trend to become last column ?

Screenshot 2025-04-08 at 22.54.59.png

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What you are asking does make much sense - the sparkline is associated with the status (which is why it appears in the same column as the other stats related to each status. What is it that you are hoping to represent by making this a column?

0 Karma

Ombessam
Path Finder

@ITWhisperer  you're right. Thanks

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...