Splunk Search

How to edit my search to combine results to make multiple rows?

RogueMrSmith
Engager

Hello Everyone,

With my current search I am able to display results in three rows, however, I need two of the rows to combine as multiple rows with populated results. For example, here's what I am getting

Name - Type - AVG
1 - -------foo----3
1----------bar--0.2
1---------cake--0.2
2----------foo--7
2----------bar--2
2----------cake--6

But what I actually need is:

NAME FOO BAR CAKE
1---------3-----0.2----0.2
2---------7-----2------6

Is there anyway to do this? Here is my search.

| rename "(002) Device.FullyQualifiedDomainName.nvarchar" AS Name |rename "(003) PerformanceAnalysisDataDiskCounter.Value.float" AS val | rename "(001) PerformanceAnalysisCounter.CounterResourceName.nvarchar" AS type|stats avg(val) as ven by Name, type| stats list(ven) AS average by Name,type
0 Karma
1 Solution

somesoni2
Revered Legend

You can replace your stats with chart command. Like this

| rename "(002) Device.FullyQualifiedDomainName.nvarchar" AS Name |rename "(003) PerformanceAnalysisDataDiskCounter.Value.float" AS val | rename "(001) PerformanceAnalysisCounter.CounterResourceName.nvarchar" AS type|stats avg(val) as ven by Name, type| chart list(ven) AS average by Name,type

View solution in original post

somesoni2
Revered Legend

You can replace your stats with chart command. Like this

| rename "(002) Device.FullyQualifiedDomainName.nvarchar" AS Name |rename "(003) PerformanceAnalysisDataDiskCounter.Value.float" AS val | rename "(001) PerformanceAnalysisCounter.CounterResourceName.nvarchar" AS type|stats avg(val) as ven by Name, type| chart list(ven) AS average by Name,type

RogueMrSmith
Engager

Thanks! That did exactly what I needed!

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...