Splunk Search

How to view percentage row to table?

SplunkNewbie18
New Member

Hi,

I've read through transpose command to try suit into the statistics I would want to view but it doesn't seems to work.

I'm having the following data in a form of table:

Table                 A           B
Cases                 1           4
Percentage            20%        80%

How do I make the Percentage to be part of a column like:

Table        A     Percentage A   B  Percentage B 
Cases        1           20%      4        80%
Tags (1)
0 Karma
1 Solution

HiroshiSatoh
Champion

If you simply convert

(your search)
|table Table A B
|stats values(*) as *
|eval Table=mvindex(Table, 0)
|eval Cases_A=mvindex(A, 0),"Percentage A"=mvindex(A, 1)
|eval Cases_B=mvindex(B, 0),"Percentage B"=mvindex(B, 1)
|rename Cases_A as A,Cases_B as B
|table Table A "Percentage A" B "Percentage B"

View solution in original post

0 Karma

HiroshiSatoh
Champion

If you simply convert

(your search)
|table Table A B
|stats values(*) as *
|eval Table=mvindex(Table, 0)
|eval Cases_A=mvindex(A, 0),"Percentage A"=mvindex(A, 1)
|eval Cases_B=mvindex(B, 0),"Percentage B"=mvindex(B, 1)
|rename Cases_A as A,Cases_B as B
|table Table A "Percentage A" B "Percentage B"
0 Karma

mayurr98
Super Champion

how did you get this table? and can you tell me what are the fields and values in that table?

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...