All Apps and Add-ons

how to Convert single row values to multiple rows after appendcols

hqw
Path Finder

Hi all,

I want to convert a table for further calculation, there are two columns and they came from different part and join by appendcols command. database_count is a standard number in my database, which is directly extracted from database and then saved as a saved report. Now I want to compare the difference in each hour of real working number. After run my search, my result is as displayed, but it only has a standard number in the first row. What I want is to fill all the rows with that number, so later I can calculate the difference by each hour.

Please kindly help. thanks.alt text

What I want:

hour    current_reporting   database_count
00            33                  494
01          25                494
02          19                494
03          15                494

My search:

NOT Reference  |eval hour=strftime(_time,"%H") | stats   values(name) as name_values   by hour  | stats dc(name_values) AS current_reporting by hour |appendcols [|savedsearch monitoring_data|search tags="*"  | stats dc(name) as database_count]
0 Karma
1 Solution

sundareshr
Legend

I think you may be able to do

.. | eventstats sum(database_count) as databasecount

View solution in original post

0 Karma

sundareshr
Legend

I think you may be able to do

.. | eventstats sum(database_count) as databasecount

0 Karma

hqw
Path Finder

Sorry Sundareshr, i misunderstood you, now it is working fine now, thanks a lot.

0 Karma

hqw
Path Finder

hello Sundareshr,

thanks for your reply, but it is not working

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...