Visualizing search results

Now that your search results are formatted, you are ready to display the data as a table or a chart.

Table/fields

Splunk can display the fields contained in each event in table format by piping the events to the table command along with a list of the fields to display, in the order in which they are to be arranged from left to right. The resultant table will contain one row per event and a column for each specified field. Splunk will automatically switch to the Statistics tab to display the resulting table.

Displaying a table of all of the fields in an event is not usually desirable; you can use the table command to specify the fields that the table is to include, and to specify the order in which...