Splunk Search

Concatenating stats results and visualizing as a single value

karthiknzx
Engager

Hi there
index=someIndex | stats = sum(fieldA) as one, sum(fieldB) as two

I would like to display the result in the format (one/two) where / is a separator. I want to visualize the output using the "Single value" visualization so I could color/enlarge the below text etc. Can you please help? (I tried using eval to concatenate the results but couldn't get it to work). Thank you.

Desired output :

100.30/200.40

where
one = 100.30
two = 200.40

Tags (1)
0 Karma
1 Solution

pradeepkumarg
Influencer

What did you try so far? something like below should work.
| eval result = one."/".two

View solution in original post

pradeepkumarg
Influencer

What did you try so far? something like below should work.
| eval result = one."/".two

karthiknzx
Engager

Thanks. This is what I tried earlier: (but I had a typo which prevented eval from working)
index=someIndex | stats = sum(fieldA) as one, sum(fieldB) as two | eval result = one."/".two
The above query produced
sum(fieldA), sum(fieldB) and result.

I just wanted the result. My query should have been: (I just stumbled upon the fields command)
index=someIndex | stats = sum(fieldA) as one, sum(fieldB) as two | eval result = one."/".two | fields result

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...