How to build a two way table?

[Clovisa]

Hi !

I am trying to build a two way table like :

|          | Male | Female | Total |
| Child    | 2    | 3      | 5     |
| Teenager | 2    | 1      | 3     |
| Adult    | 10   | 11     | 21    |

I see how to count by gender or by age but I don't see how I can have both in the same table. Your help will be very appreciated, thanks!

[gcusello · Accepted solution]

Hi Clovisa,
see the chart command ( http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Chart ).
you should try something like this

index=my_index
| chart count OVER age BY gender
| addtotals
| addcoltotals labelfield=age label="Total"

Bye.
Giuseppe

[Clovisa]

It's perfect, thanks a lot Giuseppe !