Splunk Search

## How to create a table with several fields and totals by each value

New Member

Imagine that I have a table of results like this:

``````Field1 Field2 Field3 Field4 Field5 Field6 Field7 Field8 Field9
1     0     1    0     0    3     0      0    3
1     0     3    1     0    1     1      0    0
2     0     1    0     1    3     0      0    3
1     0     3    1     0    1     1      0    1
3     0     2    0     0    3     0      0    3
1     0     3    1     0    3     0      0    1
3     1     1    0     0    1     1      0    3
0     0     3    1     1    2     1      0    1
``````

For each column I want to have the following statistics:
Field1 with 0 Values: 1
Field1 with 1 Values: 4
Field1 with 2 Values: 2
Field1 with 3 Values: 2
Field2 with 0 Values: 8
Field2 with 1 Values: 1
Field2 with 2 Values: 0
Field2 with 3 Values: 0
Field3 with 0 Values: 0
Field3 with 1 Values: 3
Field3 with 2 Values: 1
Field3 with 3 Values: 4
Field4 with 0 Values: 4
Field4 with 1 Values: 4
Field4 with 2 Values: 0
Field4 with 3 Values: 0
...
until Field9.

How can I do this? And it´s possible to adapt to a line chart?

Best Regards.

Tags (3)
Ultra Champion
``````| makeresults
| eval _raw="Field1,Field2,Field3,Field4,Field5,Field6,Field7,Field8,Field9
1,0,1,0,0,3,0,0,3
1,0,3,1,0,1,1,0,0
2,0,1,0,1,3,0,0,3
1,0,3,1,0,1,1,0,1
3,0,2,0,0,3,0,0,3
1,0,3,1,0,3,0,0,1
3,1,1,0,0,1,1,0,3
0,0,3,1,1,2,1,0,1"
| table Field1,Field2,Field3,Field4,Field5,Field6,Field7,Field8,Field9
`comment("from here , the logic")`
| eval tmp=1
| untable tmp field_name value
| eventstats count(eval(value=0)) as with0 count(eval(value=1)) as with1,
count(eval(value=2)) as with2 count(eval(value=3)) as with3 by field_name
| table field_name with*
`comment("I think above is enough, but as you want, i do")`
| untable field_name with_number value
| rex field=with_number mode=sed "s/with(\d)/with \1/"
| eval value = "value: ".value
``````

Hi, @splunk_exercice

Get Updates on the Splunk Community!

#### Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

#### Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

#### Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...