How to bring 2 different numerical fields under one column name

dtccsundar — Sat, 13 Feb 2021 14:49:27 GMT

I have to bring 2 different numerical fields in one column name .I am fetching the fields from a view .

Example :I have fields like below ,

field 1 =Compliant_machines(which has count of compliant machines )

field2 =Non_Compliant_machines(which has count of compliant machines )

I have to bring this like below ,

Compliance	sum(Count )
Compliant_Machines	123456
Non_Compliant_machines	57421

I have acheived this using transpose ,but the drill down is not working using this transpose and stats .

I am used this code for drill down ,

|search Account_Environment="*" Acc_Name="*" Baseline="*" Rule="*" |stats sum(Compliant_Tested) as Compliant sum(Noncompliant_Tested) as "Non Compliant"|transpose|rename column as "Compliance", "row 1" as "count"| search Compliance="Compliant"|table Acc_Name Acc_No Baseline form Rule " etc

The above code didnt work for me .Can someone help me to achieve this in drill down .

Re: How to bring 2 different numerical fields under one column name

ITWhisperer — Sat, 13 Feb 2021 17:05:01 GMT

|search Account_Environment="*" Acc_Name="*" Baseline="*" Rule="*" |stats sum(Compliant_Tested) as Compliant sum(Noncompliant_Tested) as Non_Compliant by Acc_Name Acc_No Baseline form Rule | eval Compliance=mvappend("Compliant_Machines","Non_Compliant_machines") | mvexpand Compliance | eval Count=if(Compliance="Compliant_Machines",Compliant,Non_Compliant) | fields - Compliant, Non_Compliant

topic Re: How to bring 2 different numerical fields under one column name in Splunk Search

How to bring 2 different numerical fields under one column name

Re: How to bring 2 different numerical fields under one column name