Splunk Search

Combine multiple searches with no relation in one table

Explorer

I have different count searches that I want to show in one report so I can send it to me as a csv file.

index=proxy host=server1 | stats count as output1
| append [search index=mail host=server2 | stats count as output2] 
| append [search index=fw host=server3 | stats count as output3]
| table output1 output2 output3

This output generates 3 columns and three rows. How can I put the count values in one row?
I couldnt update a picture so I tried to make a table:

output1 | output2 | output3
123----------------------------

-------------576---------------
---------------------------38

Tags (3)
0 Karma
1 Solution

Super Champion

Hi @igschloessl ,
try this:

|stats values(*) as *

It will get all values in single row

View solution in original post

0 Karma

Super Champion

Hi @igschloessl ,
try this:

|stats values(*) as *

It will get all values in single row

View solution in original post

0 Karma