Splunk Search

How do I add a count to a table using the table command?

Svill321
Path Finder

How do I add a count to a table using the table command? The project I'm working on requires that a table is mad showing the day of the week, followed by a list of the users who logged on that day and how many time the logged on. The output looks something like this:

=============================================
Wednesday          |                                  user1         |     5
                   |                                  user2         |     3
                   |                                  user3         |     4
                   |                                  user4         |     3
=============================================

I'm currently using this search to get some of what I need:

index=* date=* user=* | transaction date | table date user

But I can't get the count I need at the end. I tried appending a stats count:

index=* date=* user=* | transaction date | table date user | appendcols [search user=* | stats count by user]

But had no luck. Is there anyway to do this?

0 Karma
1 Solution

somesoni2
Revered Legend

I would do like this (totally avoiding transaction command), will give the output in expected format.

index=* date=* user=* | stats count by date user | stats list(user) as user list(count) as count by date

View solution in original post

somesoni2
Revered Legend

I would do like this (totally avoiding transaction command), will give the output in expected format.

index=* date=* user=* | stats count by date user | stats list(user) as user list(count) as count by date

Svill321
Path Finder

You, my friend, are a saint! This works perfectly. Thanks!

0 Karma

sbbadri
Motivator

... | addcoltotals labelfield=change_name label=count

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)

Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...

From GPU to Application: Monitoring Cisco AI Infrastructure with Splunk Observability ...

AI workloads are different. They demand specialized infrastructure—powerful GPUs, enterprise-grade networking, ...

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...