Splunk Search

How to create a table with multiple fields?

suvi6789
Path Finder

Hi,

I want to create a table in the below format and provide the count for them.
I have multiple fields in my index and I want to create a table(similar to a excel pivot) using three fields

App Name, Response code and Method 

index=abcd 
| chart count  over App Name by Response code 

--> Above works for me but I can create a table only using 2 fields. 
How to create a table something as below format  with 3 fields or more than 3.

Please could you help. 

APP NAME RESPONSECODE RESPONSECODE RESPONSECODE
200 400 400
GET POST PATCH GET POST PATCH GET POST PATCH
APP1                  
APP2                  
APP3                  
APP4                  
APP5                  
APP6                  
Labels (2)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

I am assuming that you want to get 200, 400 and 500 (not a second 400) response codes.

You can combine the response code and method and then chart by that field, e.g. see this run anywhere example but it is the last two lines you want.

| makeresults count=40
| eval responseCode=mvindex(split("200,400,500", ","), random() % 3)
| eval method=mvindex(split("GET,POST,PATCH", ","), random() % 3)
| eval app="APP".(random() % 5)
``` Use these two lines to get the chart you want ```
| eval s=responseCode."_".method
| chart count over app by s

 It will not give you a multiline header as in your image, but that's not really how Splunk does things in tables.

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

I am assuming that you want to get 200, 400 and 500 (not a second 400) response codes.

You can combine the response code and method and then chart by that field, e.g. see this run anywhere example but it is the last two lines you want.

| makeresults count=40
| eval responseCode=mvindex(split("200,400,500", ","), random() % 3)
| eval method=mvindex(split("GET,POST,PATCH", ","), random() % 3)
| eval app="APP".(random() % 5)
``` Use these two lines to get the chart you want ```
| eval s=responseCode."_".method
| chart count over app by s

 It will not give you a multiline header as in your image, but that's not really how Splunk does things in tables.

0 Karma

suvi6789
Path Finder

Hi, 
Many thanks for the update. This is helpful. 
I will consider this as a solution 

0 Karma

suvi6789
Path Finder

The table pasted has been reformated. I have attached the image of the format that I need.
Please check the attached image

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...