Splunk Search

How to split stats command results into rows

ipoluda
Explorer

I have proxy logs, in which I am interested in 4 fields: the ip address of the user's computer, the category of the site he visits and the total amount of incoming and outgoing traffic for each category. Now I got such a table, but I needed it to be like in the second table on the screenshot. I just can't find a solution, I ask the SPL guru to help me)))
My query:
index=proxy 
| stats sum(bytes_in) as totalBytesIn, sum(bytes_out) as totalBytesOut, values(category) by src_host

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is this the sort of thing you are after?

index=proxy 
| stats sum(bytes_in) as totalBytesIn, sum(bytes_out) as totalBytesOut by src_host category
| stats list(totalBytesIn) as totalBytesIn, list(totalBytesOut) as totalBytesOut, list(category) as category by src_host
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...