Splunk Search

how to combine two columns values based

snam
New Member

Hi,
I have a table like below

Name Percentage1 Percentage2
T1 25

T1 56
T2 34

T2 59

And I need a result like below

Name Percentage1 Percentage2
T1 25 56
T2 34 59

could anyone please let me know how do I achieve that in splunk?

0 Karma

dineshraj9
Builder

Considering your search returns 3 columns - Name, Percentage1, Percentage2 and each Name has only values Percentage1 and Percentage2 repeated, you can add the below to your query and achieve desired results -

| stats list(Percentage1) as Percentage1 by Name
| eval Percentage2=mvindex(Percentage1,1)
| eval Percentage1=mvindex(Percentage1,0)
0 Karma

adonio
Ultra Champion

hello there,
from your example it seems to me that there are no values to Percentage2 (but maybe i dont understand in full)
is that correct?
can you kindly share your search and some sample data?

0 Karma

lloydknight
Builder

may we see your search query?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas     Do you ever feel ...