| tstats count from datamodel=~~ where Field1="A" by B, C | eval Addition = B + C When I run above query, all values of additional fields are blank(not B+C) I want to extract those(B and C) values | eval Addition = count is possible AND It's also possible in a regular search(not tstats). But only in tstats with fields except count and _time, it is impossible to show values. How do you make this? ps. I wanna make Field1-------------------------Field2------------------NewField--------------count aaa----------------------------AAA---------------------aaaAAA----------------44 bbb----------------------------BBB---------------------bbbBBB----------------57 ccc----------------------------CCC---------------------cccCCC----------------10 from Field1-------------------------Field2------------------count aaa----------------------------AAA---------------------44 bbb----------------------------BBB---------------------57 ccc----------------------------CCC---------------------10 ... View more

Hello. I've come to ask again continuously the question I asked few days ago This is my last question: https://answers.splunk.com/answers/664833/how-to-separate-rows-as-column.html My data have 3 fields: LastName, FirstName, Age I'm using query last 2days | tstats count where LastName=* by FirstName, Age, _time span=1d prestats=true | stats count by FirstName, Age, _time then I have the result like below FirstName--------------Age---------------_time--------------------count A--------------------------24------------------2018-06-11-----------11 A--------------------------24------------------2018-06-12-----------22 A--------------------------30------------------2018-06-11-----------33 A--------------------------30------------------2018-06-12-----------44 B--------------------------26------------------2018-06-11-----------55 B--------------------------26------------------2018-06-12-----------66 and I want to make a result like FirstName--------------Age---------------2daysago_count---------1dayago_count A--------------------------24-----------------11----------------------------22 A--------------------------30-----------------33----------------------------44 B--------------------------26-----------------55----------------------------66 (Not for this question, but I'm gonna make a new column to calculate differences between 2daysago_count and 1dayago_count) What should I do? No matter which way you search, if I can use "tstats" (for time reduction) You can change from the first table to second one or make a new search or whatever Help please If I could do like above not only based on time space but also one of other fields, please let me know.. ... View more

I have trouble in manipulating the table Date contains (index, name, date). name ..... date ................ count a ............ 2018-06-07 ..... 500 a ............ 2018-06-08 ..... 600 b ............ 2018-06-07 ..... 700 b ............ 2018-06-08 ..... 800 c ............ 2018-06-07 ..... 900 c ............ 2018-06-08 ..... 1000 I want to make this table to below form name ........ day1 ........ day2 a ............... 500 .......... 600 b ............... 700 .......... 800 c ............... 900 .......... 1000 or it doesn't matter if I can make below table directly(using tstats) I have to use tstats. I already made an Alert that could show table like second table. But, It takes too much time so I want to change search command using tstats And here is the search query that I used when I made first table | tstats count where index=* by name, _time span=1d) How can I do? Somebody help me please. ... View more