Splunk Search

How do I Display fields in a table after stats command?

adamfrisbee
Explorer

Working with some Apache logs. I am trying to get a table that displays the uri, the clientip, and the number of times that clientip has hit that uri (as hits). Everything is working as expected except for that table. Why doesn't the uri part work? I get a table with uri that has blank values, and the other fields show the expected values.

 

 

index=* clientip=* uri=* 
| stats count(uri) AS hits by clientip
| table uri, hits, clientip

 

 

 Screen Shot 2020-06-28 at 9.39.16 AM.png

 

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @adamfrisbee ,

you cannot display uri because after the stats command, you can display only the fields present in stats and in you stats command there isn't the uri value.

If you want it, you should modify your search in this way:

index=* clientip=* uri=* 
| stats count(uri) AS hits values(uri) AS uri by clientip
| table uri hits clientip

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @adamfrisbee ,

you cannot display uri because after the stats command, you can display only the fields present in stats and in you stats command there isn't the uri value.

If you want it, you should modify your search in this way:

index=* clientip=* uri=* 
| stats count(uri) AS hits values(uri) AS uri by clientip
| table uri hits clientip

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @adamfrisbee,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...