Splunk Search

How to create a table?

ko1
Engager

Can we aggregate the data in the specified column?

example SPL A)
index=pan_logs  | stats count by signature,src,dest

example SPL A Result)

signature_namesrcdestcount
signature-A10.1.1.110.0.0.11
signature-B10.1.1.210.0.0.22
signature-A10.1.1.310.0.0.32
signature-B10.1.1.410.0.0.42


Want to creat table)

signature_namesrcdestcount
signature-A10.1.1.110.0.0.13
 10.1.1.310.0.0.3 
signature-B10.1.1.210.0.0.24
 10.1.1.410.0.0.4 



We want to aggregate by signature_name without changing  src<->dest combination.

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @ko1,

it's not possible to display results in the format you want, Splunk isn't Excel!

but you can do something like this:

index=pan_logs  
| eval col="src=".src." dest=".dest
| stats values(col) AS "src dest" count BY signature

Ciao.

Giuseppe

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| stats list(src) as src list(dest) as dest sum(count) as count by signature_name
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ko1,

it's not possible to display results in the format you want, Splunk isn't Excel!

but you can do something like this:

index=pan_logs  
| eval col="src=".src." dest=".dest
| stats values(col) AS "src dest" count BY signature

Ciao.

Giuseppe

ko1
Engager

Hi, @gcusello .
I will use this.
Thanks a lot!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ko1 ,

if one answer solves your need, please accept this one for the other people of Community or tell us how we can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors;-)

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...