Reporting

contingency table cell values

jrstear
Path Finder

"daysago=5 | ctable host date_wday" produces a table with hosts on rows, dates on columns, and total message count in the cells, but takes a while as it must go through all the logs and count them. I have summary index records with fields orig_host and daily_count, but how do I get it into the same format as above?

More generally: it'd be handy if ctable took an optional argument to indicate what values were put in the cells, eg "daysago=5 index=summary search_name=daily_count_by_host | ctable orig_host wday value=daily_count". It'd also be nice to be able to control the sort order of rows and columns, eg via a preceding sort. Maybe there is already a way to do this?

Thanks for any help!

-jon

Tags (2)

Stephen_Sorkin
Splunk Employee
Splunk Employee

First note that ctable is roughly equivalent to chart. The following two give the same results, except for the limit in series that will be shown:

... | ctable x y
... | chart count by x y

In your case, you don't want the count of summary events but rather the sum of the daily_count field. So your search will be:

daysago=5 index=summary search_name=daily_count_by_host
| chart sum(daily_count) by orig_host wday

jrstear
Path Finder

nevermind, timechart is good. thanks again.

0 Karma

jrstear
Path Finder

eggcellent - thanks! hmm, the cli behavior is unexpected - eg pipe to less shows incomplete results. i'm aiming for a cli that shows top N chatty hosts - any pointers on that? (i don't know if i should submit a separate question)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...