Generate a table

To generate a table, write a search that includes a transforming command. From the Search page, run the search and select the Statistics tab to view and format the table.

You can use the table command in a search to specify the fields that the table includes or to change table column order.

Search examples

• Transforming search
  This search uses the chart transforming command.

  index = _internal | chart avg(bytes) over sourcetype

  The search generates a table with two columns.
  

• Transforming search with the table command
  This search generates a table with action, host, and count columns.

  index = _internal | stats count by action, host

  

  To change the columns that appear in the table or to change column order, add the table command to this search. For example, add | table host count to generate a table with only the host and count columns.

  index = _internal | stats count by action, host | table host count

  

Table sparklines

Sparklines show data patterns or trends in a results set. To generate a table sparkline, usestats or chart with the sparkline function in a search.

Sparkline width is determined by default data binning. You can adjust data binning as a parameter of the sparkline command.

For more information, see Add Sparklines to your search results in the Search Manual.