Splunk Search

Query results with field values as column header

ma_anand1984
Contributor

I have following fields
Datacenter, Category(Cat ), Application(APP), Description(Desc).

Datacenter has 10 or more possible values.

Now i want a table like below

First line is header where Datacenter_value1 .... Datacenter_valueN are values of field Datacenter and Count is sum of counts of each Datacenter_value column

Count Datacenter_value1 Datacenter_value2 ..... Datacenter_valueN Cat APP Desc


450 5 23 ..... 37 error cycle frame error

565 16 43 ..... 56 info car engine ready

0 Karma
1 Solution

jonuwz
Influencer

Given that you rename the 'Category(Cat)' and other fields to 'Cat' 'APP' and 'Desc' up front

Join the "key" fields together first, like this :

... | eval joined_fields=Cat.";".APP.";".Desc

Then chart

... | chart count over joined_fields by Datacenter

Then add your totals

... | addtotals

Then split up the joined fields again

... | rex field=joined_fields "(?<Cat>.*?);(?<APP>.*?);(?<Desc>.*)"

Finally remove the joined_fields from the output

... | fields - joined_fields

View solution in original post

jonuwz
Influencer

Given that you rename the 'Category(Cat)' and other fields to 'Cat' 'APP' and 'Desc' up front

Join the "key" fields together first, like this :

... | eval joined_fields=Cat.";".APP.";".Desc

Then chart

... | chart count over joined_fields by Datacenter

Then add your totals

... | addtotals

Then split up the joined fields again

... | rex field=joined_fields "(?<Cat>.*?);(?<APP>.*?);(?<Desc>.*)"

Finally remove the joined_fields from the output

... | fields - joined_fields
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...