Display value from search into a report

[mickaloha]

I have a search that I useand it returns the following information.

collection="Lync Audio Video Conferencing Operations"
object="LS:AVMCU - 00 - Operations"
counter="AVMCU - 000 - Number of Conferences"
Value=7
host=LYNC-PRD-01
sourcetype=Perfmon:Lync Audio Video Conferencing Operations

source=Perfmon:Lync Audio Video Conferencing Operations

I am trying to create a report that shows the "Value" field since that is the number of conferences. How do I extract that value to a report? In the same report, I would also like to report that value from other servers via a graph of some sort. I am new to splunk and have been able to to do a count but it only counts the one server as 1 and not the actual number of conferences. Any info you can provide is welcome.

[Runals]

Would you mind sharing how you are getting that data? I'm trying to use the PowerShell SA and running into trouble.

[asimagu · Accepted solution]

if Value is always constant for each host you could do something simple like this:

stats last(Value) by host

if it is not constant and you want to get the sum by host:

stats sum(Value) by host

[asimagu]

happy to help 😉

[mickaloha]

Thank you for the help. This pointed me in the right direction on what I wanted. I actually went with stats list(Value) by host and will work through average and mean as well to get the best possible report. Also when I tired this originally, I had "Value" as "value" which was not returning any info at all. by seeing you type it out,showed me where another error I had was. Thank you once again.