Hello Splunk Community,
I have encountered a easy, yet tricky situation. I was told chart command works just like stats, so far I have all the data I need. However, the issue I have is with one field. I need to populate the setting field for the data. I get the setting field to populate, but it shows up 3 different times for each drive - I only need it to show one time.
index="123" sourcekind="Disk Space" count="% Space" dev_team=XYZ drive="C:" OR drive="E:" OR drive="F:" | chart values(setting) as setting sparkline(avg(NET),15m) as NET_value, latest(NET) as Free over server by drive
Data I receive:
server | setting:C: | setting:E: | setting:F | Free:C: | Free:E: | Free:F: | Net_Value:C: | Net_Value:E: | Net_Value:F: |
123456 | Testing | Testing | Tesing | 23.00 | 24.00 | 34.00 | \ | \ | \ |
Desired results:
server | setting | Free:C: | Free:E | Free:F | Net_Value:C: | NetValue:E: | Net_Value:F |
123456 | Testing | 23:00 | 24:00 | 34.00 | \ | \ | \ |
Since the field names are dynamic, try this method
index="123" sourcekind="Disk Space" count="% Space" dev_team=XYZ drive="C:" OR drive="E:" OR drive="F:" | chart values(setting) as setting sparkline(avg(NET),15m) as NET_value, latest(NET) as Free over server by drive
|eval settings=null()
|foreach settings:* [eval settings=if(isnull(settings),'<<FIELD>>',settings)]|fields - settings:*
Since the field names are dynamic, try this method
index="123" sourcekind="Disk Space" count="% Space" dev_team=XYZ drive="C:" OR drive="E:" OR drive="F:" | chart values(setting) as setting sparkline(avg(NET),15m) as NET_value, latest(NET) as Free over server by drive
|eval settings=null()
|foreach settings:* [eval settings=if(isnull(settings),'<<FIELD>>',settings)]|fields - settings:*
@renjith_nair Thanks so much for your help. I would like to know though why you used is null for the eval function and if there is an other way of doing the for each without the null?
|foreach settings:* [eval settings=if(isnull(settings),'<<FIELD>>',settings)]|fields - settings:*
Please advise.
sure. I just initialized the value with null and you can use any value there. It's just for checking that we are storing the value only once i.e when it's empty since all other values are same.