topic Concatenating stats results and visualizing as a single value in Splunk Search

Concatenating stats results and visualizing as a single value

karthiknzx — Thu, 11 Aug 2016 01:35:37 GMT

Hi there
index=someIndex | stats = sum(fieldA) as one, sum(fieldB) as two

I would like to display the result in the format (one/two) where / is a separator. I want to visualize the output using the "Single value" visualization so I could color/enlarge the below text etc. Can you please help? (I tried using eval to concatenate the results but couldn't get it to work). Thank you.

Desired output :

100.30/200.40

where
one = 100.30
two = 200.40

Re: Concatenating stats results and visualizing as a single value

pradeepkumarg — Thu, 11 Aug 2016 04:08:19 GMT

What did you try so far? something like below should work.
| eval result = one."/".two

Re: Concatenating stats results and visualizing as a single value

karthiknzx — Thu, 11 Aug 2016 04:50:59 GMT

Thanks. This is what I tried earlier: (but I had a typo which prevented eval from working)
index=someIndex | stats = sum(fieldA) as one, sum(fieldB) as two | eval result = one."/".two
The above query produced
sum(fieldA), sum(fieldB) and result.

I just wanted the result. My query should have been: (I just stumbled upon the fields command)
index=someIndex | stats = sum(fieldA) as one, sum(fieldB) as two | eval result = one."/".two | fields result