Splunk Search

How to bring 2 different numerical fields under one column name

dtccsundar
Path Finder

I have to bring 2 different numerical fields in one column name .I am fetching the fields from a view .

Example :I have fields like  below ,

field 1 =Compliant_machines(which has count of compliant machines )

field2 =Non_Compliant_machines(which has count of compliant machines )

I have to bring this like below ,

Compliancesum(Count )
Compliant_Machines   123456
Non_Compliant_machines57421

 

I have acheived this using transpose ,but the drill down is not working using this transpose and stats .

I am used this code for drill down ,

 |search Account_Environment="*" Acc_Name="*" Baseline="*" Rule="*" |stats sum(Compliant_Tested) as Compliant sum(Noncompliant_Tested) as "Non Compliant"|transpose|rename column as "Compliance", "row 1" as "count"| search Compliance="Compliant"|table Acc_Name Acc_No Baseline form Rule " etc

The above code didnt work for me .Can someone help me to achieve this in drill down .

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
Legend
|search Account_Environment="*" Acc_Name="*" Baseline="*" Rule="*" 
|stats sum(Compliant_Tested) as Compliant sum(Noncompliant_Tested) as Non_Compliant by Acc_Name Acc_No Baseline form Rule
| eval Compliance=mvappend("Compliant_Machines","Non_Compliant_machines")
| mvexpand Compliance
| eval Count=if(Compliance="Compliant_Machines",Compliant,Non_Compliant)
| fields - Compliant, Non_Compliant

View solution in original post

0 Karma

ITWhisperer
Legend
|search Account_Environment="*" Acc_Name="*" Baseline="*" Rule="*" 
|stats sum(Compliant_Tested) as Compliant sum(Noncompliant_Tested) as Non_Compliant by Acc_Name Acc_No Baseline form Rule
| eval Compliance=mvappend("Compliant_Machines","Non_Compliant_machines")
| mvexpand Compliance
| eval Count=if(Compliance="Compliant_Machines",Compliant,Non_Compliant)
| fields - Compliant, Non_Compliant

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!