Archive

Display value from search into a report

mickaloha
New Member

I have a search that I useand it returns the following information.

collection="Lync Audio Video Conferencing Operations"
object="LS:AVMCU - 00 - Operations"
counter="AVMCU - 000 - Number of Conferences"
Value=7
host=LYNC-PRD-01
sourcetype=Perfmon:Lync Audio Video Conferencing Operations

source=Perfmon:Lync Audio Video Conferencing Operations

I am trying to create a report that shows the "Value" field since that is the number of conferences. How do I extract that value to a report? In the same report, I would also like to report that value from other servers via a graph of some sort. I am new to splunk and have been able to to do a count but it only counts the one server as 1 and not the actual number of conferences. Any info you can provide is welcome.

Tags (1)
0 Karma
1 Solution

asimagu
Builder

if Value is always constant for each host you could do something simple like this:

stats last(Value) by host

if it is not constant and you want to get the sum by host:

stats sum(Value) by host

View solution in original post

0 Karma

Runals
Motivator

Would you mind sharing how you are getting that data? I'm trying to use the PowerShell SA and running into trouble.

0 Karma

asimagu
Builder

if Value is always constant for each host you could do something simple like this:

stats last(Value) by host

if it is not constant and you want to get the sum by host:

stats sum(Value) by host

View solution in original post

0 Karma

asimagu
Builder

happy to help 😉

0 Karma

mickaloha
New Member

Thank you for the help. This pointed me in the right direction on what I wanted. I actually went with stats list(Value) by host and will work through average and mean as well to get the best possible report. Also when I tired this originally, I had "Value" as "value" which was not returning any info at all. by seeing you type it out,showed me where another error I had was. Thank you once again.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!