Splunk Search

How to bring 2 different numerical fields under one column name

dtccsundar
Explorer

I have to bring 2 different numerical fields in one column name .I am fetching the fields from a view .

Example :I have fields like  below ,

field 1 =Compliant_machines(which has count of compliant machines )

field2 =Non_Compliant_machines(which has count of compliant machines )

I have to bring this like below ,

Compliancesum(Count )
Compliant_Machines   123456
Non_Compliant_machines57421

 

I have acheived this using transpose ,but the drill down is not working using this transpose and stats .

I am used this code for drill down ,

 |search Account_Environment="*" Acc_Name="*" Baseline="*" Rule="*" |stats sum(Compliant_Tested) as Compliant sum(Noncompliant_Tested) as "Non Compliant"|transpose|rename column as "Compliance", "row 1" as "count"| search Compliance="Compliant"|table Acc_Name Acc_No Baseline form Rule " etc

The above code didnt work for me .Can someone help me to achieve this in drill down .

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
Legend
|search Account_Environment="*" Acc_Name="*" Baseline="*" Rule="*" 
|stats sum(Compliant_Tested) as Compliant sum(Noncompliant_Tested) as Non_Compliant by Acc_Name Acc_No Baseline form Rule
| eval Compliance=mvappend("Compliant_Machines","Non_Compliant_machines")
| mvexpand Compliance
| eval Count=if(Compliance="Compliant_Machines",Compliant,Non_Compliant)
| fields - Compliant, Non_Compliant

View solution in original post

0 Karma

ITWhisperer
Legend
|search Account_Environment="*" Acc_Name="*" Baseline="*" Rule="*" 
|stats sum(Compliant_Tested) as Compliant sum(Noncompliant_Tested) as Non_Compliant by Acc_Name Acc_No Baseline form Rule
| eval Compliance=mvappend("Compliant_Machines","Non_Compliant_machines")
| mvexpand Compliance
| eval Count=if(Compliance="Compliant_Machines",Compliant,Non_Compliant)
| fields - Compliant, Non_Compliant

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.