Splunk Search

How do I add a count to a table using the table command?

Svill321
Path Finder

How do I add a count to a table using the table command? The project I'm working on requires that a table is mad showing the day of the week, followed by a list of the users who logged on that day and how many time the logged on. The output looks something like this:

=============================================
Wednesday          |                                  user1         |     5
                   |                                  user2         |     3
                   |                                  user3         |     4
                   |                                  user4         |     3
=============================================

I'm currently using this search to get some of what I need:

index=* date=* user=* | transaction date | table date user

But I can't get the count I need at the end. I tried appending a stats count:

index=* date=* user=* | transaction date | table date user | appendcols [search user=* | stats count by user]

But had no luck. Is there anyway to do this?

0 Karma
1 Solution

somesoni2
Revered Legend

I would do like this (totally avoiding transaction command), will give the output in expected format.

index=* date=* user=* | stats count by date user | stats list(user) as user list(count) as count by date

View solution in original post

somesoni2
Revered Legend

I would do like this (totally avoiding transaction command), will give the output in expected format.

index=* date=* user=* | stats count by date user | stats list(user) as user list(count) as count by date

Svill321
Path Finder

You, my friend, are a saint! This works perfectly. Thanks!

0 Karma

sbbadri
Motivator

... | addcoltotals labelfield=change_name label=count

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...