Splunk Search

How to add a new row, and copy some values from other rows, while changing others.

xaxvier
Engager

Hello all, 

I currently have the following data set, and a table will look like this:

TestIterationResults
Test11400
Test12500
Test13600
Test201000
Test21500
Test221000
Test232000

 

We run a test several times and save the results for each time. 

What I need to do is to calculate iteration 0 for the tests that don't have it (test1), which will be a median of all other iterations available. What I want to do is add a new for, with the new value: 

TestIterationResults
Test10500
Test11400
Test12500
Test13600
Test201000
Test21500
Test221000
Test232000

 

It needs to add only the iteration 0 for those tests that doesnt have it, and ignore the other cases.

I've tried using appendpipe + eventstats, but It only rewrites the Iteration and Value fields:

|appendpipe [ |eventstats median(Results) as Results, first(Test) as Test,  | eval iteration=0 ]

I would like to get some ideas on how to do this. 

Any help will be appreciated, thank you in advance. 

Labels (2)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...