Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Creating a table with multiple fields
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I want to create a table in the below format and provide the count for them.
I have multiple fields in my index and I want to create a table(similar to a excel pivot) using three fields
App Name, Response code and Method
index=abcd
| chart count over App Name by Response code
--> Above works for me but I can create a table only using 2 fields.
How to create a table something as below format with 3 fields or more than 3.
Please could you help.
| APP NAME | RESPONSECODE | RESPONSECODE | RESPONSECODE | ||||||
| 200 | 400 | 400 | |||||||
| GET | POST | PATCH | GET | POST | PATCH | GET | POST | PATCH | |
| APP1 | |||||||||
| APP2 | |||||||||
| APP3 | |||||||||
| APP4 | |||||||||
| APP5 | |||||||||
| APP6 |
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am assuming that you want to get 200, 400 and 500 (not a second 400) response codes.
You can combine the response code and method and then chart by that field, e.g. see this run anywhere example but it is the last two lines you want.
| makeresults count=40
| eval responseCode=mvindex(split("200,400,500", ","), random() % 3)
| eval method=mvindex(split("GET,POST,PATCH", ","), random() % 3)
| eval app="APP".(random() % 5)
``` Use these two lines to get the chart you want ```
| eval s=responseCode."_".method
| chart count over app by sIt will not give you a multiline header as in your image, but that's not really how Splunk does things in tables.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am assuming that you want to get 200, 400 and 500 (not a second 400) response codes.
You can combine the response code and method and then chart by that field, e.g. see this run anywhere example but it is the last two lines you want.
| makeresults count=40
| eval responseCode=mvindex(split("200,400,500", ","), random() % 3)
| eval method=mvindex(split("GET,POST,PATCH", ","), random() % 3)
| eval app="APP".(random() % 5)
``` Use these two lines to get the chart you want ```
| eval s=responseCode."_".method
| chart count over app by sIt will not give you a multiline header as in your image, but that's not really how Splunk does things in tables.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Many thanks for the update. This is helpful.
I will consider this as a solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Index This | What travels the world but is also stuck in place?
Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data
Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...
