Splunk Search

display results with columns

mataharry
Communicator

I am trying to make a search parameters which can group the different parameters in a single column and display as multiple columns, for example, for server1, there can be lot of incidents with different severity values, for example

Server Name | Severity 
Server1     |   1 
Server1     |   2 
Server1     |   3 

This has to be be represented in this format

Server Name | Severity 1 | Severity 2 | Severity 3
Server1     |    10      |     5      |    4 
Server 2    |     8      |     9      |    8 
Tags (1)
1 Solution

sideview
SplunkTrust
SplunkTrust
<your search> | chart count over "Server Name" by Severity

And if you really want to turn the severity values into "Severity 1" instead of just "1" in the columns:

<your search> | eval Severity="Severity " + Severity | chart count over "Server Name" by Severity

View solution in original post

sideview
SplunkTrust
SplunkTrust
<your search> | chart count over "Server Name" by Severity

And if you really want to turn the severity values into "Severity 1" instead of just "1" in the columns:

<your search> | eval Severity="Severity " + Severity | chart count over "Server Name" by Severity

yannK
Splunk Employee
Splunk Employee

What is the format of your severity field, is it extracted ?

If you want to count the number of events per severity per host. you can try to collate the result of 3 searches, one per severity level.

* severity1 | stats count as severity1 by host 
| appendcols [ search * severity2 | stats count as severity2 by host ] 
| appendcols [ search * severity3 | stats count as severity3 by host ] 
0 Karma

sideview
SplunkTrust
SplunkTrust

it is much better to just use the chart command.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...