Splunk Search

How to edit my search to combine results to make multiple rows?

RogueMrSmith
Engager

Hello Everyone,

With my current search I am able to display results in three rows, however, I need two of the rows to combine as multiple rows with populated results. For example, here's what I am getting

Name - Type - AVG
1 - -------foo----3
1----------bar--0.2
1---------cake--0.2
2----------foo--7
2----------bar--2
2----------cake--6

But what I actually need is:

NAME FOO BAR CAKE
1---------3-----0.2----0.2
2---------7-----2------6

Is there anyway to do this? Here is my search.

| rename "(002) Device.FullyQualifiedDomainName.nvarchar" AS Name |rename "(003) PerformanceAnalysisDataDiskCounter.Value.float" AS val | rename "(001) PerformanceAnalysisCounter.CounterResourceName.nvarchar" AS type|stats avg(val) as ven by Name, type| stats list(ven) AS average by Name,type
0 Karma
1 Solution

somesoni2
Revered Legend

You can replace your stats with chart command. Like this

| rename "(002) Device.FullyQualifiedDomainName.nvarchar" AS Name |rename "(003) PerformanceAnalysisDataDiskCounter.Value.float" AS val | rename "(001) PerformanceAnalysisCounter.CounterResourceName.nvarchar" AS type|stats avg(val) as ven by Name, type| chart list(ven) AS average by Name,type

View solution in original post

somesoni2
Revered Legend

You can replace your stats with chart command. Like this

| rename "(002) Device.FullyQualifiedDomainName.nvarchar" AS Name |rename "(003) PerformanceAnalysisDataDiskCounter.Value.float" AS val | rename "(001) PerformanceAnalysisCounter.CounterResourceName.nvarchar" AS type|stats avg(val) as ven by Name, type| chart list(ven) AS average by Name,type

RogueMrSmith
Engager

Thanks! That did exactly what I needed!

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...