topic Re: How to Merge count two different field values in Splunk Search

How to Merge count two different field values

Manasi25 — Wed, 05 Aug 2020 12:48:52 GMT

I have different Fields values like - teamNameTOC, teamNameEngine under same field Name(teamName) want to merge these two values in single report.

I have tried below and output also attached

teamName=DA OR teamName=DBA OR teamName=Engine OR teamName=SE OR teamName=TOC | top limit=50 teamName

OUTPUT

teamName count percent
TOC 233 50.000000
Engine 84 18.025751
DA 66 14.163090
SE 55 11.802575
DBA 28

I need all above values Count (team name , count , %) in one row as single entity. % should adjust itself if add new more values.

Output should look like -

teamName count percent

All Teams 466 100.00

Re: How to Merge count two different field values

richgalloway — Wed, 05 Aug 2020 14:29:34 GMT

It's not clear what the final result should be. If you want a total row in addition to the existing results then try this search:

teamName=DA OR teamName=DBA OR teamName=Engine OR teamName=SE OR teamName=TOC | top limit=50 teamName | addcoltotals labelfield=teamName label="All Teams"

Re: How to Merge count two different field values

Manasi25 — Thu, 06 Aug 2020 04:08:10 GMT

HI. Thank you for reply.

Solution you given resulted same as mine mentioned commands.

I need "All Teams"'s count ONLY the output and want to rename "All teams" as a "IA".

Re: How to Merge count two different field values

richgalloway — Thu, 06 Aug 2020 12:20:59 GMT

Try this:

Re: How to Merge count two different field values

Manasi25 — Mon, 10 Aug 2020 05:52:28 GMT

Thank you so much ! Its worked good.

Kindly let me know, how can I add one more row of another fields to get result as below-

I have field values for "IB" and need to add row below the result of"IA".

Fileds Values -

teamName=A OR teamName=B OR teamName=C OR teamName=D OR teamName=E | top limit=50 teamName

RoutingKey Count Percentage

IA 250 100.00

IB count %

Re: How to Merge count two different field values

richgalloway — Mon, 10 Aug 2020 12:39:04 GMT

You should be able to do that with the append command.

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

Re: How to Merge count two different field values

Manasi25 — Tue, 11 Aug 2020 11:27:14 GMT

Thank you so much ! It worked.

Re: How to Merge count two different field values

Manasi25 — Sun, 06 Sep 2020 07:40:22 GMT

Hi Rich

Solution you given worked perfectly, but its parsing my output and getting time for result.

Also, I need average of all results , but it do sum of all avg in Totals. Plz advise.