Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- Re: Display value from search into a report
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a search that I useand it returns the following information.
collection="Lync Audio Video Conferencing Operations"
object="LS:AVMCU - 00 - Operations"
counter="AVMCU - 000 - Number of Conferences"
Value=7
host=LYNC-PRD-01
sourcetype=Perfmon:Lync Audio Video Conferencing Operations
source=Perfmon:Lync Audio Video Conferencing Operations
I am trying to create a report that shows the "Value" field since that is the number of conferences. How do I extract that value to a report? In the same report, I would also like to report that value from other servers via a graph of some sort. I am new to splunk and have been able to to do a count but it only counts the one server as 1 and not the actual number of conferences. Any info you can provide is welcome.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
if Value is always constant for each host you could do something simple like this:
stats last(Value) by host
if it is not constant and you want to get the sum by host:
stats sum(Value) by host
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Would you mind sharing how you are getting that data? I'm trying to use the PowerShell SA and running into trouble.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
if Value is always constant for each host you could do something simple like this:
stats last(Value) by host
if it is not constant and you want to get the sum by host:
stats sum(Value) by host
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
happy to help 😉
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for the help. This pointed me in the right direction on what I wanted. I actually went with stats list(Value) by host and will work through average and mean as well to get the best possible report. Also when I tired this originally, I had "Value" as "value" which was not returning any info at all. by seeing you type it out,showed me where another error I had was. Thank you once again.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
