Splunk Search

How to combine data based on a common field?

anooshac
Communicator

Hi all, i have some data task name, execution date, link uploaded earlier. Now i want to add some more data related to the task name they are component name, number of components. If i upload the 2nd data in the form task name , component name, number of components will i be able to get all data together based on one common field task name. Can anyone knows is there any solution for this?

My data are task name, execution date, link and the next set of data  is task name , component name, number of components.

Labels (3)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Yes, you can either use join or stats by task name to aggregate the values from the fields on a common take name.

0 Karma

anooshac
Communicator

I don't want to just display the data directly using stats. My raw data has alot of processing to do and using join i am joining all these processed results. Is there any solution other than this?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Stats, just like any command, works on the events in the pipeline; you can choose where you put the stats command; you can have more than one stats command if that helps your use case.

0 Karma

anooshac
Communicator

when i use stats all the data including the data i don't want to display also shows. How to avoid these? I tried by putting table command after stats for the selected data but that doesn't work.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The table command can be used to limit the fields/columns - the where command can be used to limit the event/rows

0 Karma

anooshac
Communicator

Okay. Thank you so much.

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...