Reporting

Display value from search into a report

mickaloha
New Member

I have a search that I useand it returns the following information.

collection="Lync Audio Video Conferencing Operations"
object="LS:AVMCU - 00 - Operations"
counter="AVMCU - 000 - Number of Conferences"
Value=7
host=LYNC-PRD-01
sourcetype=Perfmon:Lync Audio Video Conferencing Operations

source=Perfmon:Lync Audio Video Conferencing Operations

I am trying to create a report that shows the "Value" field since that is the number of conferences. How do I extract that value to a report? In the same report, I would also like to report that value from other servers via a graph of some sort. I am new to splunk and have been able to to do a count but it only counts the one server as 1 and not the actual number of conferences. Any info you can provide is welcome.

Tags (1)
0 Karma
1 Solution

asimagu
Builder

if Value is always constant for each host you could do something simple like this:

stats last(Value) by host

if it is not constant and you want to get the sum by host:

stats sum(Value) by host

View solution in original post

0 Karma

Runals
Motivator

Would you mind sharing how you are getting that data? I'm trying to use the PowerShell SA and running into trouble.

0 Karma

asimagu
Builder

if Value is always constant for each host you could do something simple like this:

stats last(Value) by host

if it is not constant and you want to get the sum by host:

stats sum(Value) by host

0 Karma

asimagu
Builder

happy to help 😉

0 Karma

mickaloha
New Member

Thank you for the help. This pointed me in the right direction on what I wanted. I actually went with stats list(Value) by host and will work through average and mean as well to get the best possible report. Also when I tired this originally, I had "Value" as "value" which was not returning any info at all. by seeing you type it out,showed me where another error I had was. Thank you once again.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...