topic How to add another column from the same index with stats function? in Splunk Enterprise

How to add another column from the same index with stats function?

Neel881 — Thu, 02 Mar 2023 15:27:10 GMT

Hello all,

How to add another column from the same index with stats function?

I have used join because I need 30 days data even with 0. Please suggest.

Re: How to add another column from the same index with stats function?

ITWhisperer — Thu, 02 Mar 2023 15:59:48 GMT

Have you tried this: (timechart uses earliest and latest (info_min_time and info_max_time respectively) and should fill in the missing days automatically)

index="*appevent" Type="*splunk" | timechart span=1d count as "Total" | eval "New_Date"=strftime(_time,"%Y-%m-%d") | table "New_Date" "Total"

Re: How to add another column from the same index with stats function?

richgalloway — Thu, 02 Mar 2023 16:07:51 GMT

You can use append instead of join.

Or you can let timechart fill in the zeros.

index="*appevent" Type="*splunk" | timechart span=1d count as Total by _time | eval "New_Date"=strftime(_time,"%Y-%m-%d") | table "New_Date" "Total"

Re: How to add another column from the same index with stats function?

Neel881 — Fri, 03 Mar 2023 12:20:41 GMT

Thank you for your response.

I need to add another column from the same index ('index="*appevent" Type="*splunk" ). Column name is 'Type'. My question is how to add column 'Type' with the existing query?

Expecting output-

Re: How to add another column from the same index with stats function?

Neel881 — Fri, 03 Mar 2023 12:45:01 GMT

Thank you for your response.

I getting I need to add another column from the same index ('index="*appevent" Type="*splunk" ). Column name is 'Type'. My question is how to add column 'Type' with the existing query?

Expecting output-

Re: How to add another column from the same index with stats function?

ITWhisperer — Fri, 03 Mar 2023 13:03:44 GMT

index="*appevent" Type="*splunk" | timechart span=1d count as "Total" by Type | eval "New_Date"=strftime(_time,"%Y-%m-%d") | untable New_Date Type Total

Re: How to add another column from the same index with stats function?

richgalloway — Fri, 03 Mar 2023 13:28:54 GMT

The stats command is a transforming command so it discards any fields it doesn't produce or group by. Add new fields to stats to get them in the output.

Re: How to add another column from the same index with stats function?

Neel881 — Fri, 03 Mar 2023 13:33:26 GMT

Its working thank you so much!

Re: How to add another column from the same index with stats function?

Neel881 — Wed, 08 Mar 2023 13:15:14 GMT

Hi,

How to add/join another column from the same search? Phase is the another column in the same index.

index="*appevent" Type="*splunk" 
| timechart span=1d count as "Total" by Type
| eval "New_Date"=strftime(_time,"%Y-%m-%d")
| untable New_Date Type Total

Pls suggest