Generate a table

To generate a table, write a search that includes a transforming command. From the Search page, run the search and select the Statistics tab to view and format the table.

You can use the table command in a search to specify the fields that the table includes or to change table column order.

Search examples

  • Transforming search

    This search uses the chart transforming command.

    index = _internal | chart avg(bytes) over sourcetype

    The search generates a table with two columns.

    7.1 transforming search.png

  • Transforming search with the table command

    This search generates a table with action, host, and count columns.

    index = _internal | stats count by action, host

    7.1 transforming search table.png

    To change the columns that appear in the table or to change column order, add the table command to this search. For example, add | table host count to generate a table with only the host and count columns.

    index = _internal | stats count by action, host | table host count

    7.1 transforming searh table host.png

Table sparklines

Sparklines show data patterns or trends in a results set. To generate a table sparkline, usestats or chart with the sparkline function in a search.

Sparkline width is determined by default data binning. You can adjust data binning as a parameter of the sparkline command.

For more information, see Add Sparklines to your search results in the Search Manual.