Splunk Search

format splunk table

edookati
Path Finder

I have 3 fields date, hour & count(X). can someone please tell me how to forma table like below...count of X

      date1       date2 

Hour1 count(X) count(X)
Hour2 count(X) count(X)

Thanks.

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

I am assuming you have some aggregation command like "stats" to get those three columns. If that is the case I would recommend to rename the "count(X)" as countX or something similar.

Try this

Your base search giving date, hour , countX fields | chart sum(countX) as countX over hour by date

OR

Your base search giving date, hour, X fields | chart count(X) as countX over hour by date

OR

your base search giving date, hour, count(X) fields | chart sum("count(X)") as countX over hour by date

View solution in original post

somesoni2
Revered Legend

I am assuming you have some aggregation command like "stats" to get those three columns. If that is the case I would recommend to rename the "count(X)" as countX or something similar.

Try this

Your base search giving date, hour , countX fields | chart sum(countX) as countX over hour by date

OR

Your base search giving date, hour, X fields | chart count(X) as countX over hour by date

OR

your base search giving date, hour, count(X) fields | chart sum("count(X)") as countX over hour by date

edookati
Path Finder

fantastic. It worked.
Thanks.

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...