Splunk Search

How to create a table with multiple fields?

suvi6789
Path Finder

Hi,

I want to create a table in the below format and provide the count for them.
I have multiple fields in my index and I want to create a table(similar to a excel pivot) using three fields

App Name, Response code and Method 

index=abcd 
| chart count  over App Name by Response code 

--> Above works for me but I can create a table only using 2 fields. 
How to create a table something as below format  with 3 fields or more than 3.

Please could you help. 

APP NAME RESPONSECODE RESPONSECODE RESPONSECODE
200 400 400
GET POST PATCH GET POST PATCH GET POST PATCH
APP1                  
APP2                  
APP3                  
APP4                  
APP5                  
APP6                  
Labels (2)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

I am assuming that you want to get 200, 400 and 500 (not a second 400) response codes.

You can combine the response code and method and then chart by that field, e.g. see this run anywhere example but it is the last two lines you want.

| makeresults count=40
| eval responseCode=mvindex(split("200,400,500", ","), random() % 3)
| eval method=mvindex(split("GET,POST,PATCH", ","), random() % 3)
| eval app="APP".(random() % 5)
``` Use these two lines to get the chart you want ```
| eval s=responseCode."_".method
| chart count over app by s

 It will not give you a multiline header as in your image, but that's not really how Splunk does things in tables.

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

I am assuming that you want to get 200, 400 and 500 (not a second 400) response codes.

You can combine the response code and method and then chart by that field, e.g. see this run anywhere example but it is the last two lines you want.

| makeresults count=40
| eval responseCode=mvindex(split("200,400,500", ","), random() % 3)
| eval method=mvindex(split("GET,POST,PATCH", ","), random() % 3)
| eval app="APP".(random() % 5)
``` Use these two lines to get the chart you want ```
| eval s=responseCode."_".method
| chart count over app by s

 It will not give you a multiline header as in your image, but that's not really how Splunk does things in tables.

0 Karma

suvi6789
Path Finder

Hi, 
Many thanks for the update. This is helpful. 
I will consider this as a solution 

0 Karma

suvi6789
Path Finder

The table pasted has been reformated. I have attached the image of the format that I need.
Please check the attached image

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...