Splunk Search

How to create a table?

ko1
Engager

Can we aggregate the data in the specified column?

example SPL A)
index=pan_logs  | stats count by signature,src,dest

example SPL A Result)

signature_namesrcdestcount
signature-A10.1.1.110.0.0.11
signature-B10.1.1.210.0.0.22
signature-A10.1.1.310.0.0.32
signature-B10.1.1.410.0.0.42


Want to creat table)

signature_namesrcdestcount
signature-A10.1.1.110.0.0.13
 10.1.1.310.0.0.3 
signature-B10.1.1.210.0.0.24
 10.1.1.410.0.0.4 



We want to aggregate by signature_name without changing  src<->dest combination.

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @ko1,

it's not possible to display results in the format you want, Splunk isn't Excel!

but you can do something like this:

index=pan_logs  
| eval col="src=".src." dest=".dest
| stats values(col) AS "src dest" count BY signature

Ciao.

Giuseppe

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| stats list(src) as src list(dest) as dest sum(count) as count by signature_name
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ko1,

it's not possible to display results in the format you want, Splunk isn't Excel!

but you can do something like this:

index=pan_logs  
| eval col="src=".src." dest=".dest
| stats values(col) AS "src dest" count BY signature

Ciao.

Giuseppe

ko1
Engager

Hi, @gcusello .
I will use this.
Thanks a lot!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ko1 ,

if one answer solves your need, please accept this one for the other people of Community or tell us how we can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors;-)

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...