Hi Rune,
Could you throw in an eval with if to NULL out the pmi_current you don't need, combined with the answer from somesoni2? As far as I understand you're only interested in the pmi_current from one of the events, i.e.
| eval pmi_current=if(pmi_statistics_name == "ActiveCount", pmi_current, NULL)
?
Not sure if that's what you're looking for, just an idea 🙂
You could also check this out: http://answers.splunk.com/answers/93930/how-to-create-a-new-field-with-values-in-existing-field-based-on-the-values-in-other-field
You might lose some important data with this approach though. I guess your BY clause would be pmi_statistics_name
... View more