Splunk Search

How can I add a static value into a table row?

kcchu01
Explorer

I would like to create a dashboard to have some charts for showing statistics of occurrence. The query for plotting the chart is as follows.

| chart count(range) as "Count" by range

But, I would like to include the device with the range = 0. i.e. Which cannot be logged with Splunk but I have the static value that is calculated by Total - Count(range>0), how can I insert this value into the table so that it can be plotted on the chart?

I know that the scenario is little bit hard to understand, to put it briefly , I would like to add a static value as one of the data into the existing table. Is it possible to do that?

0 Karma

harishalipaka
Motivator

hi @kcchu01

if you want row use append or appendpipe

or fi you want add column use appendcols

*********All the Best***********

kcchu01
Explorer

Thanks a lot for your help , I get it now

0 Karma

RHASQaL
Path Finder

You could probably use the append SPL command just prior to the chart command

Dave

0 Karma
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...