Splunk Search

How to add a new row, and copy some values from other rows, while changing others.

xaxvier
Engager

Hello all, 

I currently have the following data set, and a table will look like this:

TestIterationResults
Test11400
Test12500
Test13600
Test201000
Test21500
Test221000
Test232000

 

We run a test several times and save the results for each time. 

What I need to do is to calculate iteration 0 for the tests that don't have it (test1), which will be a median of all other iterations available. What I want to do is add a new for, with the new value: 

TestIterationResults
Test10500
Test11400
Test12500
Test13600
Test201000
Test21500
Test221000
Test232000

 

It needs to add only the iteration 0 for those tests that doesnt have it, and ignore the other cases.

I've tried using appendpipe + eventstats, but It only rewrites the Iteration and Value fields:

|appendpipe [ |eventstats median(Results) as Results, first(Test) as Test,  | eval iteration=0 ]

I would like to get some ideas on how to do this. 

Any help will be appreciated, thank you in advance. 

Labels (2)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...