Splunk Search

How to extract field values in eval with tstats?

apple143
Engager
| tstats count from datamodel=~~ where Field1="A" by B, C
| eval Addition = B + C

When I run above query, all values of additional fields are blank(not B+C)

I want to extract those(B and C) values

| eval Addition = count is possible

AND

It's also possible in a regular search(not tstats).

But only in tstats with fields except count and _time, it is impossible to show values.

How do you make this?

ps.
I wanna make

Field1-------------------------Field2------------------NewField--------------count
aaa----------------------------AAA---------------------aaaAAA----------------44
bbb----------------------------BBB---------------------bbbBBB----------------57
ccc----------------------------CCC---------------------cccCCC----------------10

from

Field1-------------------------Field2------------------count
aaa----------------------------AAA---------------------44
bbb----------------------------BBB---------------------57
ccc----------------------------CCC---------------------10
Tags (3)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@apple143

Try:

| eval Addition = B.C

Smaple:

| makeresults | eval Field1="aaa",Field2="AAA" | eval NewField=Field1.Field2

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@apple143

Try:

| eval Addition = B.C

Smaple:

| makeresults | eval Field1="aaa",Field2="AAA" | eval NewField=Field1.Field2

apple143
Engager

oh I got it
it was not problem of "tstats"
When I tried to extract values from the column, the column name contained "." character.
I think it made error.

I used rename and change field name without "." character.
After then, It worked.

Thank you

0 Karma

apple143
Engager

I aleady tried that

It works in standard search.
It doesn't work when I used "tstats" search

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Can you share output?

| tstats count from datamodel=~~ where Field1="A" by B, C
| table Addition B C

?
Are B and C has simple field name. if not then try it rename it,
eg.
node1.field1 as B
node1.field2 as C

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!