Splunk Search

how to create table for multiple data?

jasklee
Engager

I need to create a table which will display

workweek as rows

and subarea as column, meanwhile the data inside will display the passing percentage for each subarea for every workweek.

i tried

*|stats count(eval(status="Failed")) AS fail,count(eval(status="Passed")) AS pass by workweek|eval passPercentage=if(pass+fail== 0, "-",round(pass/(pass+fail)*100,2))|fields workweek,passPercentage

This will only calculate for overall passPercentage for each workweek, but i want it to be done with each subarea of each workweek...

0 Karma

yannK
Splunk Employee
Splunk Employee

what about creating a field for your subarea and use it as a new by condition ?

*
| eval subarea=case(status="Passed","pass",status="Failed","fail",1=1,"other")
|chart count over workweek by subarea
| eval total=pass+fail
|eval passPercentage=if(total== 0, "-",round(pass/(total)*100,2))
|fields workweek,passPercentage

jasklee
Engager

thank you yannK,
but i still cant get the things that i want =(

my data should display something like this

             subArea1 subArea2 subArea3...

workweek1 12 32 88
workweek2 96 45 12
workweek3 23 78 43
workweek4 37 79 98

0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...