Splunk Search

How can I condense this search?

klsio
Explorer

I have this search

| eval max = round(max, 2)
| eval avg = round(avg, 2)
| eval median = round(median,2)
| eval min = round(min, 2)
.....

but I want to condense this search to just 1 line.

Can I do this?

0 Karma

renjith_nair
Legend

You can club it in your aggregation function itself.

Eg :

index=*|stats count  as number by sourcetype
|chart eval(round(avg(number),2)) as avg,eval(round(max(number),2)) as max,eval(round(min(number),2)) as min
---
What goes around comes around. If it helps, hit it with Karma 🙂

klsio
Explorer

thank you for your answer.
And I found "foreach".

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...