Hi Splunkers;
I'm trying to create a table but can't and don't understand how to do...
I'd like to calculate stats avg, max and exactperc90 on 8 fields values adding a by 2 other fields values.
my problem is to use as a field value his own field name.
I'm not shure my explains are clear, tried to draw it.
any one have done this before?
Thanks a lot for support.
Thanks for your answer.
but not what i need.
what i need is the request for:
-the 1st and 2nd columns are "| stats by" u_ci_name and component_value
-the 3rd column is a list of "fields names" caled "traffic*" by u_ci_name and component_value
-the lasts columns are avg/max/perc by u_ci_name and component_value and fields names
hope you see what i mean.
thanks a lot.
You can rename fields in the stats command e.g.
| stats avg(count) as Average
Or use the rename command
| rename Avg as Average