Splunk Search

how to display data with multiple column and row?

jasklee
Engager

I need to create a table which will display

workweek as rows

and subarea as column, meanwhile the data inside will display the passing percentage for each subarea for every workweek.

i tried

*|stats count(eval(status="Failed")) AS fail,count(eval(status="Passed")) AS pass by workweek|eval passPercentage=if(pass+fail== 0, "-",round(pass/(pass+fail)*100,2))|fields workweek,passPercentage

This will only calculate for overall passPercentage for each workweek, but i want it to be done with each subarea of each workweek...

my sample output will be like this

              subArea1 subArea2 subArea3...

workweek1 12 32 88

workweek2 96 45 12

workweek3 23 78 43

workweek4 37 79 98

Tags (4)
0 Karma

lguinn2
Legend

Try this

yoursearchhere
| stats count(eval(status="Failed")) as fail, count(eval(status="Passed")) as pass by workweek subArea
| eval passPercentage=if(pass+fail== 0, "-",round(pass/(pass+fail)*100,2))
| xyseries workweek subArea passPercentage
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...