Splunk Search

how to combine two columns values based

snam
New Member

Hi,
I have a table like below

Name Percentage1 Percentage2
T1 25

T1 56
T2 34

T2 59

And I need a result like below

Name Percentage1 Percentage2
T1 25 56
T2 34 59

could anyone please let me know how do I achieve that in splunk?

0 Karma

dineshraj9
Builder

Considering your search returns 3 columns - Name, Percentage1, Percentage2 and each Name has only values Percentage1 and Percentage2 repeated, you can add the below to your query and achieve desired results -

| stats list(Percentage1) as Percentage1 by Name
| eval Percentage2=mvindex(Percentage1,1)
| eval Percentage1=mvindex(Percentage1,0)
0 Karma

adonio
Ultra Champion

hello there,
from your example it seems to me that there are no values to Percentage2 (but maybe i dont understand in full)
is that correct?
can you kindly share your search and some sample data?

0 Karma

lloydknight
Builder

may we see your search query?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...