Splunk Search

format splunk table

Path Finder

I have 3 fields date, hour & count(X). can someone please tell me how to forma table like below...count of X

      date1       date2 

Hour1 count(X) count(X)
Hour2 count(X) count(X)

Thanks.

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

I am assuming you have some aggregation command like "stats" to get those three columns. If that is the case I would recommend to rename the "count(X)" as countX or something similar.

Try this

Your base search giving date, hour , countX fields | chart sum(countX) as countX over hour by date

OR

Your base search giving date, hour, X fields | chart count(X) as countX over hour by date

OR

your base search giving date, hour, count(X) fields | chart sum("count(X)") as countX over hour by date

View solution in original post

SplunkTrust
SplunkTrust

I am assuming you have some aggregation command like "stats" to get those three columns. If that is the case I would recommend to rename the "count(X)" as countX or something similar.

Try this

Your base search giving date, hour , countX fields | chart sum(countX) as countX over hour by date

OR

Your base search giving date, hour, X fields | chart count(X) as countX over hour by date

OR

your base search giving date, hour, count(X) fields | chart sum("count(X)") as countX over hour by date

View solution in original post

Path Finder

fantastic. It worked.
Thanks.

0 Karma