Knowledge Management

How to add a row into a table, the row depends on a search result, which is before the first Pipe (|)?

ganinurceski
Engager

index="Value of index" tag="Value of Tag" DATA="code for data1" | chart count by parameter1 | rename count as "Count of DATA" | sort - "Count of DATA"

As a result, i want to see a table, which display every parameter1 Value, the count of data1 and count of data2 (which isnt in the string within) but both data values seperate. What can I do?

0 Karma

woodcock
Esteemed Legend

Like this:

index="index" AND tag="tag" AND (DATA="code for data1" OR DATA="code for data2")
| chart count(eval(DATA="code for data1")) AS data1count count(eval(DATA="code for data2")) AS data2count BY paraeter1
| sort 0 - data1count data2count
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ganinurceski,
in a table you have rows and columns, if I correctly understood, in first row there are values for data 1 and in the second values for data 2 that come from another search.
But columns must be the same in both the searches, otherwise how can you create a table?

if this is your need, you should try something like this

(index="Value of index 1" tag="Value of Tag 1" DATA="code for data 1") OR (index="Value of index 2" tag="Value of Tag 2" DATA="code for data2")
| eval my_search=if(index="Value of index 1","First search","Second search") 
| chart count OVER my_search BY parameter1  
| sort - "my_search"

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...