Splunk Search

help on basic table

jip31
Motivator

Hello

I use the search below :

[| inputlookup host.csv 
    | table host] index="x" sourcetype="PerfmonMk:Process" process_name=chrome ("%_Processor_Time"=0) 
| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE 
| search SITE=$tok_filtersite|s$ 
| stats  count(process_name) as Total by host
| sort -Total limit=10

I need to display host, SITE and Total fields
I m doing

   | table host SITE Total

But SITE doenst display
What I have to do please?

Tags (1)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

When you use stats in your query it will drop remaining fields. So try this | stats count(process_name) as Total, values(SITE) as SITE by host

View solution in original post

0 Karma

harsmarvania57
Ultra Champion

Hi,

When you use stats in your query it will drop remaining fields. So try this | stats count(process_name) as Total, values(SITE) as SITE by host

0 Karma

jip31
Motivator

Oh many thanks

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...