https://community.splunk.com/t5/Splunk-Search/results-into-a-single-row-table/m-p/37643#M8454 <P>Seeing the example searches and data would be useful indeed. Without them, though, we can still do some handwaving toward an answer. This may not be correct, depending on your exact searches, but it should get you in the ballpark.</P> <P>Let's start by putting all three of your searches together. This is far from the most efficient way, but it's what works with all I have to go on:</P> <PRE><CODE>search1 | append [ search search2 ] | append [ search search3] </CODE></PRE> <P>The <CODE>append</CODE> search command will run each of these three searches and append their results together. The additional word <CODE>search</CODE> in the subsearches for search2/search3 is required as part of the subsearch.</P> <P>Now, I'll make an assumption that "search1" returns an extracted field named "up", "search2" returns extracted fields named "failed" and "success", and "search3" returns an extracted field named "down". I'll also assume that the field names "up", "failed", "success", and "down" are unique and exclusive to their respective searches. (That is, "search1" does NOT have an extracted field named "failed", "success", or "down" ... and so on)</P> <P>Given the above assumptions, we know that the <CODE>stats</CODE> operation <CODE>max()</CODE> should only find a single value to be "the" maximum for a given field. So, we can use stats to collapse this into a single table row:</P> <PRE><CODE>... (above search) ... | stats max(up) as up, max(failed) as failed, max(success) as success, max(down) as down </CODE></PRE> <P>Giving you a single table row for results from all three searches ...</P> Thu, 16 Aug 2012 23:45:55 GMT dwaddle 2012-08-16T23:45:55Z https://community.splunk.com/t5/Splunk-Search/results-into-a-single-row-table/m-p/37641#M8452 <P>Hi,</P> <P>I have three search results giving me three different set of results, there are values from each search. I have not been able to find a way to get the results into a single row table.</P> <P>I need merge all these result into a single row in a single table.</P> <P>The structure of the search I have used is given below. </P> <P>[ search 1 ] </P> <P>[ search 2 ] </P> <P>[ search 3 ] </P> <P>the resulting table should look like</P> <PRE><CODE> up failed success down </CODE></PRE> <P>results search1 results search2 results search2 results search3</P> <P>Appreciate any help!</P> Thu, 16 Aug 2012 20:30:18 GMT https://community.splunk.com/t5/Splunk-Search/results-into-a-single-row-table/m-p/37641#M8452 fresned 2012-08-16T20:30:18Z https://community.splunk.com/t5/Splunk-Search/results-into-a-single-row-table/m-p/37642#M8453 <P>Can you post the searches?</P> Thu, 16 Aug 2012 21:21:48 GMT https://community.splunk.com/t5/Splunk-Search/results-into-a-single-row-table/m-p/37642#M8453 tfletcher_splun 2012-08-16T21:21:48Z https://community.splunk.com/t5/Splunk-Search/results-into-a-single-row-table/m-p/37643#M8454 <P>Seeing the example searches and data would be useful indeed. Without them, though, we can still do some handwaving toward an answer. This may not be correct, depending on your exact searches, but it should get you in the ballpark.</P> <P>Let's start by putting all three of your searches together. This is far from the most efficient way, but it's what works with all I have to go on:</P> <PRE><CODE>search1 | append [ search search2 ] | append [ search search3] </CODE></PRE> <P>The <CODE>append</CODE> search command will run each of these three searches and append their results together. The additional word <CODE>search</CODE> in the subsearches for search2/search3 is required as part of the subsearch.</P> <P>Now, I'll make an assumption that "search1" returns an extracted field named "up", "search2" returns extracted fields named "failed" and "success", and "search3" returns an extracted field named "down". I'll also assume that the field names "up", "failed", "success", and "down" are unique and exclusive to their respective searches. (That is, "search1" does NOT have an extracted field named "failed", "success", or "down" ... and so on)</P> <P>Given the above assumptions, we know that the <CODE>stats</CODE> operation <CODE>max()</CODE> should only find a single value to be "the" maximum for a given field. So, we can use stats to collapse this into a single table row:</P> <PRE><CODE>... (above search) ... | stats max(up) as up, max(failed) as failed, max(success) as success, max(down) as down </CODE></PRE> <P>Giving you a single table row for results from all three searches ...</P> Thu, 16 Aug 2012 23:45:55 GMT https://community.splunk.com/t5/Splunk-Search/results-into-a-single-row-table/m-p/37643#M8454 dwaddle 2012-08-16T23:45:55Z