Splunk Search

How to create a table with multiple fields?

suvi6789
Path Finder

Hi,

I want to create a table in the below format and provide the count for them.
I have multiple fields in my index and I want to create a table(similar to a excel pivot) using three fields

App Name, Response code and Method 

index=abcd 
| chart count  over App Name by Response code 

--> Above works for me but I can create a table only using 2 fields. 
How to create a table something as below format  with 3 fields or more than 3.

Please could you help. 

APP NAME RESPONSECODE RESPONSECODE RESPONSECODE
200 400 400
GET POST PATCH GET POST PATCH GET POST PATCH
APP1                  
APP2                  
APP3                  
APP4                  
APP5                  
APP6                  
Labels (2)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

I am assuming that you want to get 200, 400 and 500 (not a second 400) response codes.

You can combine the response code and method and then chart by that field, e.g. see this run anywhere example but it is the last two lines you want.

| makeresults count=40
| eval responseCode=mvindex(split("200,400,500", ","), random() % 3)
| eval method=mvindex(split("GET,POST,PATCH", ","), random() % 3)
| eval app="APP".(random() % 5)
``` Use these two lines to get the chart you want ```
| eval s=responseCode."_".method
| chart count over app by s

 It will not give you a multiline header as in your image, but that's not really how Splunk does things in tables.

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

I am assuming that you want to get 200, 400 and 500 (not a second 400) response codes.

You can combine the response code and method and then chart by that field, e.g. see this run anywhere example but it is the last two lines you want.

| makeresults count=40
| eval responseCode=mvindex(split("200,400,500", ","), random() % 3)
| eval method=mvindex(split("GET,POST,PATCH", ","), random() % 3)
| eval app="APP".(random() % 5)
``` Use these two lines to get the chart you want ```
| eval s=responseCode."_".method
| chart count over app by s

 It will not give you a multiline header as in your image, but that's not really how Splunk does things in tables.

0 Karma

suvi6789
Path Finder

Hi, 
Many thanks for the update. This is helpful. 
I will consider this as a solution 

0 Karma

suvi6789
Path Finder

The table pasted has been reformated. I have attached the image of the format that I need.
Please check the attached image

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...