Reporting

How to do table formatting in a report?

3DGjos
Communicator

Hello

I am working in a report and I need help with some delta columns that I added to it. My idea is to send this monthly.

So far my query is this:

 

index=metricas_soc_summary source=TMCS_INCAPSULA_SUMMARY_MENSUAL  earliest=-90d@d latest=@mon | rename attack as "Tipo de ataque" 

| timechart span=1mon cont=FALSE count as "Cantidad de ataques" values(mes) as mes by "Tipo de ataque" 
| eval mes=strftime(_time, "%m"), mes=case(mes="01", "enero", mes="02", "febrero", mes="03","marzo",mes="04","abril",mes="05",mayo,mes="06","junio",mes="07","julio",mes="08","agosto",mes="09","septiembre",mes="10","octubre",mes="11","noviembre",mes="12","diciembre",1==1,null())  | delta "Cantidad de ataques: Ataque de DDoS" | delta "Cantidad de ataques: Ataques de autenticación" | delta "Cantidad de ataques: Ataques externos"

 

(dont mind the eval mes, because i will use it to send the previous month value $result.mes$ in the email body, if posible after the transpose?)

This generates this table:

3DGjos_0-1596067589622.pngit has to look like this:

3DGjos_1-1596067811862.png

if possible, I'd adore the deltas expressed in % too. but not entirely neccessary.
and if possible, it has to still have the value of month (mes in spanish) to add it to the email body, but its not neccesary.

Thanks for the help

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...