Splunk Search

display results with columns

mataharry
Communicator

I am trying to make a search parameters which can group the different parameters in a single column and display as multiple columns, for example, for server1, there can be lot of incidents with different severity values, for example

Server Name | Severity 
Server1     |   1 
Server1     |   2 
Server1     |   3 

This has to be be represented in this format

Server Name | Severity 1 | Severity 2 | Severity 3
Server1     |    10      |     5      |    4 
Server 2    |     8      |     9      |    8 
Tags (1)
1 Solution

sideview
SplunkTrust
SplunkTrust
<your search> | chart count over "Server Name" by Severity

And if you really want to turn the severity values into "Severity 1" instead of just "1" in the columns:

<your search> | eval Severity="Severity " + Severity | chart count over "Server Name" by Severity

View solution in original post

sideview
SplunkTrust
SplunkTrust
<your search> | chart count over "Server Name" by Severity

And if you really want to turn the severity values into "Severity 1" instead of just "1" in the columns:

<your search> | eval Severity="Severity " + Severity | chart count over "Server Name" by Severity

yannK
Splunk Employee
Splunk Employee

What is the format of your severity field, is it extracted ?

If you want to count the number of events per severity per host. you can try to collate the result of 3 searches, one per severity level.

* severity1 | stats count as severity1 by host 
| appendcols [ search * severity2 | stats count as severity2 by host ] 
| appendcols [ search * severity3 | stats count as severity3 by host ] 
0 Karma

sideview
SplunkTrust
SplunkTrust

it is much better to just use the chart command.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...