Knowledge Management

How to add a row into a table, the row depends on a search result, which is before the first Pipe (|)?


index="Value of index" tag="Value of Tag" DATA="code for data1" | chart count by parameter1 | rename count as "Count of DATA" | sort - "Count of DATA"

As a result, i want to see a table, which display every parameter1 Value, the count of data1 and count of data2 (which isnt in the string within) but both data values seperate. What can I do?

0 Karma

Esteemed Legend

Like this:

index="index" AND tag="tag" AND (DATA="code for data1" OR DATA="code for data2")
| chart count(eval(DATA="code for data1")) AS data1count count(eval(DATA="code for data2")) AS data2count BY paraeter1
| sort 0 - data1count data2count
0 Karma

Esteemed Legend

Hi @ganinurceski,
in a table you have rows and columns, if I correctly understood, in first row there are values for data 1 and in the second values for data 2 that come from another search.
But columns must be the same in both the searches, otherwise how can you create a table?

if this is your need, you should try something like this

(index="Value of index 1" tag="Value of Tag 1" DATA="code for data 1") OR (index="Value of index 2" tag="Value of Tag 2" DATA="code for data2")
| eval my_search=if(index="Value of index 1","First search","Second search") 
| chart count OVER my_search BY parameter1  
| sort - "my_search"


0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...