https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159068#M44855 <P>Hi @shellnight</P> <P>Please be sure that when responding to someone's answer, click on "Add comment" directly below their answer or, if responding to someone's comment, type in the "Add your comment..." box directly below their comment. You keep typing your responses in the "Enter your answer here..." box at the very bottom of the page which, instead, posts a brand new answer when it was really meant as a comment. This will help with a clean continuous flow of the conversation. It gets especially confusing when there are multiple answers on your post and people have no idea who you're responding to. I already converted your "answers" to comments, so just something to keep in mind from here on out. </P> Wed, 17 Jun 2015 18:19:37 GMT ppablo 2015-06-17T18:19:37Z https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159060#M44847 <P>Is there any way the results of a normal search and threshold search can be combine and displayed in a single table on the dashboard ?</P> <P>The data i have is just 2 fields . Machine name and its problem</P> <P>machine1 - disk failure<BR /> machine2 - virus failure<BR /> machine 3 - cpu utlization 15%<BR /> machine4 0- cpyu utlization 80%<BR /> machine5 - ram crash </P> <P>I want the results to be displayed as below ignoring the machine with CPU with 15% utlization and only display machine with cpu utlization higher than 50%</P> <P>So the results of the table should be :</P> <P>machine1 - disk failure<BR /> machine2 - virus failure<BR /> machine4 0- cpyu utlization 80%<BR /> machine5 - ram crash </P> Wed, 17 Jun 2015 10:19:30 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159060#M44847 shellnight 2015-06-17T10:19:30Z https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159061#M44848 <P>hi shellnight,</P> <PRE><CODE>your search producing | where machine != machine3 </CODE></PRE> <P>or</P> <PRE><CODE> your search producing | where machine != "machine3" </CODE></PRE> Wed, 17 Jun 2015 11:01:44 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159061#M44848 gyslainlatsa 2015-06-17T11:01:44Z https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159062#M44849 <P>its not just about machine3 , the purpose of the search is to exclude all those results which have cpu utlization less than 50% </P> Wed, 17 Jun 2015 11:12:07 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159062#M44849 shellnight 2015-06-17T11:12:07Z https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159063#M44850 <P>you said that: "The data i have is just 2 fields . Machine name and its problem"<BR /> i call Machine name field -----&gt;&gt;&gt; Machine_name<BR /> and problem field -----&gt;&gt;&gt; machine_problem<BR /> then try like:</P> <PRE><CODE>your search producing | stats list(eval(machine_problem!="cpu utlization 15%")) as list_of_machine_problem by Machine_name </CODE></PRE> Mon, 28 Sep 2020 20:18:44 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159063#M44850 fdi01 2020-09-28T20:18:44Z https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159064#M44851 <P>Sorry ,A correction is required . There are 3 fields </P> <P>Machine name<BR /> problem type<BR /> Count </P> <P>i need the list of machine where the count is higher than 50 for cpu utlization along with normal search </P> Wed, 17 Jun 2015 11:46:43 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159064#M44851 shellnight 2015-06-17T11:46:43Z https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159065#M44852 <P>hello Mr shellnight covert your answer in text comment.<BR /> to do it covert your answer in comment.</P> <P>and to search where the count is higher than 50 for cpu utlization <BR /> try this:</P> <PRE><CODE>your search producing |table *| where count &gt;50 </CODE></PRE> Wed, 17 Jun 2015 12:09:40 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159065#M44852 fdi01 2015-06-17T12:09:40Z https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159066#M44853 <P>^^ hi fdi01 , I dont see any mention CPU utlization in the query that you have provided above . Please note that i need to see all other event types + the ones where CPU is higher than 50% </P> <P>The table should look like this </P> <P>machine1 - disk failure<BR /> machine2 - virus failure<BR /> machine4 0- cpu utlization 80<BR /> machine5 - ram crash</P> Wed, 17 Jun 2015 13:50:13 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159066#M44853 shellnight 2015-06-17T13:50:13Z https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159067#M44854 <P>I am afraid you are not understanding the request.</P> <P>I need the list of all problems in machine but exclude the occurences for cpu utlization less than 50</P> Wed, 17 Jun 2015 15:25:19 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159067#M44854 shellnight 2015-06-17T15:25:19Z https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159068#M44855 <P>Hi @shellnight</P> <P>Please be sure that when responding to someone's answer, click on "Add comment" directly below their answer or, if responding to someone's comment, type in the "Add your comment..." box directly below their comment. You keep typing your responses in the "Enter your answer here..." box at the very bottom of the page which, instead, posts a brand new answer when it was really meant as a comment. This will help with a clean continuous flow of the conversation. It gets especially confusing when there are multiple answers on your post and people have no idea who you're responding to. I already converted your "answers" to comments, so just something to keep in mind from here on out. </P> Wed, 17 Jun 2015 18:19:37 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159068#M44855 ppablo 2015-06-17T18:19:37Z https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159069#M44856 <P>hi fdi01 , I dont see any mention CPU utlization in the query that you have provided above . Please note that i need to see all other event types + the ones where CPU is higher than 50%</P> <P>The table should look like this</P> <P>machine1 - disk failure<BR /> machine2 - virus failure<BR /> machine4 0- cpu utlization 80<BR /> machine5 - ram crash</P> <P>shellnight · 17 hours ago<BR /> I am afraid you are not understanding the request.</P> <P>I need the list of all problems in machine but exclude the occurences for cpu utlization less than 50</P> Thu, 18 Jun 2015 10:10:23 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-impossible-to-combine-the-results-of-a-normal-search-and/m-p/159069#M44856 shellnight 2015-06-18T10:10:23Z