Splunk Search

How to display the values in search result as fields?

cycheng
Path Finder

I have a search which return below results:

status      total_user
passed      7
failed      3
unknown     14

How can I change the table so that it can display like this:

passed     failed    unknown    total
  7          3         14         24

I tried this but it is not working:
stats values(eval(status="passed")) AS passed values(eval(status="failed")) AS failed values(eval(status="unknown")) AS unknown sum(total_user) AS Total

Tags (1)
0 Karma

Gilberto_Castil
Splunk Employee
Splunk Employee

Add this at the end of your original search string. I will format the data in the desired format.

... | eval dummy=" " | xyseries dummy status total_user | fields - dummy | addtotals

I hope this helps.

cycheng
Path Finder

Thanks! It solved my problem. 🙂

0 Karma

woodcock
Esteemed Legend

Then you should come back and click Accept to close the question, @cycheng.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...