Splunk Search

How to add a new row, and copy some values from other rows, while changing others.

xaxvier
Engager

Hello all, 

I currently have the following data set, and a table will look like this:

TestIterationResults
Test11400
Test12500
Test13600
Test201000
Test21500
Test221000
Test232000

 

We run a test several times and save the results for each time. 

What I need to do is to calculate iteration 0 for the tests that don't have it (test1), which will be a median of all other iterations available. What I want to do is add a new for, with the new value: 

TestIterationResults
Test10500
Test11400
Test12500
Test13600
Test201000
Test21500
Test221000
Test232000

 

It needs to add only the iteration 0 for those tests that doesnt have it, and ignore the other cases.

I've tried using appendpipe + eventstats, but It only rewrites the Iteration and Value fields:

|appendpipe [ |eventstats median(Results) as Results, first(Test) as Test,  | eval iteration=0 ]

I would like to get some ideas on how to do this. 

Any help will be appreciated, thank you in advance. 

Labels (2)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...