Splunk Search

How to split stats command results into rows

ipoluda
Explorer

I have proxy logs, in which I am interested in 4 fields: the ip address of the user's computer, the category of the site he visits and the total amount of incoming and outgoing traffic for each category. Now I got such a table, but I needed it to be like in the second table on the screenshot. I just can't find a solution, I ask the SPL guru to help me)))
My query:
index=proxy 
| stats sum(bytes_in) as totalBytesIn, sum(bytes_out) as totalBytesOut, values(category) by src_host

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is this the sort of thing you are after?

index=proxy 
| stats sum(bytes_in) as totalBytesIn, sum(bytes_out) as totalBytesOut by src_host category
| stats list(totalBytesIn) as totalBytesIn, list(totalBytesOut) as totalBytesOut, list(category) as category by src_host
0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...