Splunk Search

How to search and table count for multiple fields?

vtsguerrero
Contributor

Can anyone help me making this table?
I have the field Status, wich has events Status=1, Status=2, Status=3.
I need to count events for each and make a table for each, example

Channel | Total Status = 1 | Total Status = 2 | Total Status = 3

Channel A
Channel B
Channel C

This is my current query:

index=main sourcetype=control | stats count, values(Status) as Status by STATUS | table Channel, count

Tags (3)
1 Solution

Ayn
Legend
index=main sourcetype=control | chart count over Channel by STATUS

?

View solution in original post

Ayn
Legend
index=main sourcetype=control | chart count over Channel by STATUS

?

vtsguerrero
Contributor

Thanks a lot Ayn! Solved my problems! 😄

0 Karma

vtsguerrero
Contributor

I forgot to mention that this table should also show per Channel for each line :X
What's the easiest way I can do this?

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...