All Apps and Add-ons

how to Convert single row values to multiple rows after appendcols

hqw
Path Finder

Hi all,

I want to convert a table for further calculation, there are two columns and they came from different part and join by appendcols command. database_count is a standard number in my database, which is directly extracted from database and then saved as a saved report. Now I want to compare the difference in each hour of real working number. After run my search, my result is as displayed, but it only has a standard number in the first row. What I want is to fill all the rows with that number, so later I can calculate the difference by each hour.

Please kindly help. thanks.alt text

What I want:

hour    current_reporting   database_count
00            33                  494
01          25                494
02          19                494
03          15                494

My search:

NOT Reference  |eval hour=strftime(_time,"%H") | stats   values(name) as name_values   by hour  | stats dc(name_values) AS current_reporting by hour |appendcols [|savedsearch monitoring_data|search tags="*"  | stats dc(name) as database_count]
0 Karma
1 Solution

sundareshr
Legend

I think you may be able to do

.. | eventstats sum(database_count) as databasecount

View solution in original post

0 Karma

sundareshr
Legend

I think you may be able to do

.. | eventstats sum(database_count) as databasecount

0 Karma

hqw
Path Finder

Sorry Sundareshr, i misunderstood you, now it is working fine now, thanks a lot.

0 Karma

hqw
Path Finder

hello Sundareshr,

thanks for your reply, but it is not working

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>