Splunk Search

How to combine data based on a common field?

anooshac
Communicator

Hi all, i have some data task name, execution date, link uploaded earlier. Now i want to add some more data related to the task name they are component name, number of components. If i upload the 2nd data in the form task name , component name, number of components will i be able to get all data together based on one common field task name. Can anyone knows is there any solution for this?

My data are task name, execution date, link and the next set of data  is task name , component name, number of components.

Labels (2)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Yes, you can either use join or stats by task name to aggregate the values from the fields on a common take name.

0 Karma

anooshac
Communicator

I don't want to just display the data directly using stats. My raw data has alot of processing to do and using join i am joining all these processed results. Is there any solution other than this?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Stats, just like any command, works on the events in the pipeline; you can choose where you put the stats command; you can have more than one stats command if that helps your use case.

0 Karma

anooshac
Communicator

when i use stats all the data including the data i don't want to display also shows. How to avoid these? I tried by putting table command after stats for the selected data but that doesn't work.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The table command can be used to limit the fields/columns - the where command can be used to limit the event/rows

0 Karma

anooshac
Communicator

Okay. Thank you so much.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...