Dashboards & Visualizations

headache stats by fields name and values


Hi Splunkers;

I'm trying to create a table but can't and don't understand how to do...

I'd like to calculate stats avg, max and exactperc90 on 8 fields values adding a by 2 other fields values.

my problem is to use as a field value his own field name.

I'm not shure my explains are clear, tried to draw it.


any one have done this before?

Thanks a lot for support.

Labels (1)
0 Karma


Thanks for your answer.

but not what i need.

what i need is the request for:

-the 1st and 2nd columns are "| stats by" u_ci_name and component_value

-the 3rd column is a list of "fields names" caled "traffic*" by u_ci_name and component_value

-the lasts columns are avg/max/perc by u_ci_name and component_value and fields names


hope you see what i mean.

thanks a lot.

0 Karma


You can rename fields in the stats command e.g.

| stats avg(count) as Average

Or use the rename command

| rename Avg as Average


*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>