Splunk Search

How to make table in Splunk

logloganathan
Motivator

Please provide different examples so that its very easy for us to understand.
explaining the example with eval command will be awarded.

Labels (1)
Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

Generate a table
To generate a table, write a search that includes a transforming command. From the Search page, run the search and select the Statistics tab to view and format the table.

You can use the table command in a search to specify the fields that the table includes or to change table column order.

Search examples
1) Transforming search
This search uses the chart transforming command.

index = _internal | chart avg(bytes) over sourcetype

2) Transforming search with the table command
This search generates a table with action, host, and count columns.

index = _internal | stats count by action, host

To change the columns that appear in the table or to change column order, add the table command to this search. For example, add | table host count to generate a table with only the host and count columns.

index = _internal | stats count by action, host | table host count

3) Using eval

| makeresults 
  | eval field_a ="My Value A", field_b ="Other Value B" 
  | table [|makeresults |  eval search ="field_a field_b" | table search ]

Also, have a look at this table command reference doc there are many examples in this
https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Table

let me know if this helps!

View solution in original post

Taruchit
Contributor

Hello All, 

Can you please help to make following type of tables using | makeresults command: -

Column1Column2
C1A,B,C
C2D,E,F,G
C3X

 

Column1Column2
C1A
C1B
C1C
C2D
C2E
C2F
C2G
C3X

 

Thank you

0 Karma

vinod743374
Communicator

| makeresults | eval column1= "c1",column2="A,B,C"
|append[| makeresults | eval column1= "c2",column2="D,E,F,G"]
|append[| makeresults | eval column1= "c3",column2="X"]
| fields - _time


You can try like this.

Taruchit
Contributor

Thank you, it worked successfully. 

0 Karma

mayurr98
Super Champion

Generate a table
To generate a table, write a search that includes a transforming command. From the Search page, run the search and select the Statistics tab to view and format the table.

You can use the table command in a search to specify the fields that the table includes or to change table column order.

Search examples
1) Transforming search
This search uses the chart transforming command.

index = _internal | chart avg(bytes) over sourcetype

2) Transforming search with the table command
This search generates a table with action, host, and count columns.

index = _internal | stats count by action, host

To change the columns that appear in the table or to change column order, add the table command to this search. For example, add | table host count to generate a table with only the host and count columns.

index = _internal | stats count by action, host | table host count

3) Using eval

| makeresults 
  | eval field_a ="My Value A", field_b ="Other Value B" 
  | table [|makeresults |  eval search ="field_a field_b" | table search ]

Also, have a look at this table command reference doc there are many examples in this
https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Table

let me know if this helps!

logloganathan
Motivator

thanks for your answer

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...