Splunk Search

how to display data with multiple column and row?

jasklee
Engager

I need to create a table which will display

workweek as rows

and subarea as column, meanwhile the data inside will display the passing percentage for each subarea for every workweek.

i tried

*|stats count(eval(status="Failed")) AS fail,count(eval(status="Passed")) AS pass by workweek|eval passPercentage=if(pass+fail== 0, "-",round(pass/(pass+fail)*100,2))|fields workweek,passPercentage

This will only calculate for overall passPercentage for each workweek, but i want it to be done with each subarea of each workweek...

my sample output will be like this

              subArea1 subArea2 subArea3...

workweek1 12 32 88

workweek2 96 45 12

workweek3 23 78 43

workweek4 37 79 98

Tags (4)
0 Karma

lguinn2
Legend

Try this

yoursearchhere
| stats count(eval(status="Failed")) as fail, count(eval(status="Passed")) as pass by workweek subArea
| eval passPercentage=if(pass+fail== 0, "-",round(pass/(pass+fail)*100,2))
| xyseries workweek subArea passPercentage
0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...