Dashboards & Visualizations

How to create search do calculations and make it like Excel row data?

FcwfCW76
Explorer
Hi, all!
I have a table

FcwfCW76_0-1644419654330.png

I want to be like this

FcwfCW76_1-1644418803423.png

How can I do this?
Can help me?

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="A,1,2,3,4,HI,HELLO,OK
B,5,6,7,8,HI,HELLO,OK"
| multikv noheader=t
| rename Column_1 as name
| rename Column_2 as in
| rename Column_3 as out
| rename Column_4 as in1
| rename Column_5 as out1
| rename Column_6 as data1
| rename Column_7 as data2
| rename Column_8 as data3
| fields name in out in1 out1 data1 data2 data3
| fields - _raw _time
| transpose 0 header_field=name column_name=name
| eval C=if(isnum(A),(A*2)+B,A)
| eval D=if(isnum(A),(A*2)+(B*2),A)
| transpose 0 header_field=name column_name=name

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 header_field=name column_name=name
| eval C=(A*2)+B
| eval D=(A*2)+(B*2)
| transpose 0 header_field=name column_name=name

Where name is the name of the first column

FcwfCW76
Explorer

@ITWhisperer Thank you so much 

But the columns that is not a number is null, is it can to join at the same time?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean you don't have the first column of your table in splunk?

If so, you can add a field (column) to each row before the transpose

| streamstats count as row
| eval row="row".row
| transpose 0 header_field=row column_name=row
| eval row3=(row1*2)+row2
| eval row4=(row1*2)+(row2*2)
| transpose 0 header_field=row column_name=row
0 Karma

FcwfCW76
Explorer

@ITWhisperer Sorry I can't express clearly

858F23EB-E09D-459F-99A0-C3723C8CCBCB.png

 I want this

E262124E-1414-4073-B770-AB911631640C.png

 but now is this

E528A5A0-2D80-473D-B02D-5EAC3F76A178.png

 Thanks again for your help

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="A,1,2,3,4,HI,HELLO,OK
B,5,6,7,8,HI,HELLO,OK"
| multikv noheader=t
| rename Column_1 as name
| rename Column_2 as in
| rename Column_3 as out
| rename Column_4 as in1
| rename Column_5 as out1
| rename Column_6 as data1
| rename Column_7 as data2
| rename Column_8 as data3
| fields name in out in1 out1 data1 data2 data3
| fields - _raw _time
| transpose 0 header_field=name column_name=name
| eval C=if(isnum(A),(A*2)+B,A)
| eval D=if(isnum(A),(A*2)+(B*2),A)
| transpose 0 header_field=name column_name=name
0 Karma

FcwfCW76
Explorer

Thank you

0 Karma

FcwfCW76
Explorer

@ITWhisperer 

Thank you so much

but I still have a lot of questions

Can you give me your contact information?

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...