Splunk Search

Split a column in the search data into multiple columns

shiv1593
Communicator

Hi All,

I have a file of Tickets to analyse. I want to arrange the data as per the following image. What can I do to achieve the same.

alt text

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi shiv1593,
try something like this

your_search
| chart sum(number) AS number OVER region BY priority
| addtotals
| addcoltotals labelfield=region

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi shiv1593,
try something like this

your_search
| chart sum(number) AS number OVER region BY priority
| addtotals
| addcoltotals labelfield=region

Bye.
Giuseppe

shiv1593
Communicator

Hi Giuseppe,

I tried. It didn't work. I am fairly new to Splunk, can you look at my query with your query added and see whether am I doing something wrong?

host="service_desk_tickets" Number="" Region="" Priority="*"
| eval Region = upper(Region)
| stats count(Number) by Region Priority
| rename count(Number) as "Total"
| chart sum(Number) AS Number OVER Region BY Priority
| addtotals
| addcoltotals labelfield=Region

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
the field in sum must be the one in the previous stats (rename for you):

host="service_desk_tickets" Number="*" Region="*" Priority="*" 
| eval Region = upper(Region)
| stats count(Number) AS Number by Region Priority
| chart sum(Number) AS Number OVER Region BY Priority
| addtotals
| addcoltotals labelfield=Region

Only few hints:

  • when you share a code use Code Sample button (icon 101010), otherwise some char isn't correctly showed,
  • use always index=index_name because search is quicker,
  • put rename in stats,
  • don't use Total as field name because it's the same used in addcoltotals command.

Bye.
Giuseppe

0 Karma

shiv1593
Communicator

Thanks a lot, Giuseppe. That was really helpful. I will take into account your tips.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...