Generate a table
To generate a table, write a search that includes a transforming command. From the Search page, run the search and select the Statistics tab to view and format the table.
You can use the table
command in a search to specify the fields that the table includes or to change table column order.
Search examples
- Transforming search
This search uses thechart
transforming command.index = _internal | chart avg(bytes) over sourcetype
- Transforming search with the table command
This search generates a table withaction
,host
, andcount
columns.index = _internal | stats count by action, host
To change the columns that appear in the table or to change column order, add the
table
command to this search. For example, add| table host count
to generate a table with only thehost
andcount
columns.index = _internal | stats count by action, host | table host count
Table sparklines
Sparklines show data patterns or trends in a results set. To generate a table sparkline, usestats
or chart
with the sparkline
function in a search.
Sparkline width is determined by default data binning. You can adjust data binning as a parameter of the sparkline
command.
For more information, see Add Sparklines to your search results in the Search Manual.
Table visualization overview | Format table visualizations |
This documentation applies to the following versions of Splunk® Enterprise: 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1
Feedback submitted, thanks!