Splunk Search

How do I Display fields in a table after stats command?

adamfrisbee
Explorer

Working with some Apache logs. I am trying to get a table that displays the uri, the clientip, and the number of times that clientip has hit that uri (as hits). Everything is working as expected except for that table. Why doesn't the uri part work? I get a table with uri that has blank values, and the other fields show the expected values.

 

 

index=* clientip=* uri=* 
| stats count(uri) AS hits by clientip
| table uri, hits, clientip

 

 

 Screen Shot 2020-06-28 at 9.39.16 AM.png

 

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @adamfrisbee ,

you cannot display uri because after the stats command, you can display only the fields present in stats and in you stats command there isn't the uri value.

If you want it, you should modify your search in this way:

index=* clientip=* uri=* 
| stats count(uri) AS hits values(uri) AS uri by clientip
| table uri hits clientip

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @adamfrisbee ,

you cannot display uri because after the stats command, you can display only the fields present in stats and in you stats command there isn't the uri value.

If you want it, you should modify your search in this way:

index=* clientip=* uri=* 
| stats count(uri) AS hits values(uri) AS uri by clientip
| table uri hits clientip

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @adamfrisbee,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...