How to create a table when my logs have the same field names but different values?

[balleste]

I have the following separate event logs in Splunk:

"10/3/2016 11:30:24 AM","42646.7711166204","mail-server-01","mail-server-01","emails Received","emails Received","0 #","100.00"

"10/3/2016 11:30:50 AM","42646.7714199537","mail-server-01","mail-server-01","cpu","cpu","0 #","25.00"

They are different log events, but have the same fields:

1. 10/3/2016: date
2. 11:30:50 AM: time
3. mail-server-01: host
4. cpu or emails received: sensor
5. 100.00 or 25.00: value_raw

I'd like to make a table to show the following (but having hard time with the same field values):

|mail-server-01 |100.00 |25.00 |

[sundareshr · Accepted solution]

Try this

base search | chart values(value_raw) as values over host by sensor

*OR*

base search | chart avg(value_raw) as values over host by sensor

[balleste]

Thank you sundareshr! This will work, but if I had multiple sensors that I don't want as part of the table and I only want a subset...is there a better way than doing a query like this?

base search | NOT "disk-free" NOT "mem-usage" | chart values(value_raw) as values over host by sensor

[sundareshr]

Yes, you can do

base search NOT (sensor="disk-free" OR sensor="mem-usage") | chart values(value_raw) as values over host by sensor