Hi, I'm hoping someone can help me I currently have some queries I run that I can looking to automate into Splunk. One of them in particular involves a case statement that has different outcomes when I change this to run in Splunk it puts it all onto one line treating it as one event is there any way to display this in splunk? Some sample data is below: Case speed strength weight height Person 1 100 130 70 50 Person 2 120 100 80 55 Person 3 150 150 80 60 Person 4 70 90 70 65 Person 5 60 30 90 70 Person 6 20 100 100 75 So for the sample output of this query in splunk key pair values would be like: Wed Mar 20 14:00:01 GMT 2013 Case="Person1"speed="100"strength="130"weight="70"height="50" Case="Person2"speed="120"strength="100"weight="80"height="55" I now want to search this in splunk and compare the values of each person together i.e speed vs speed etc. Is this possible? Any help would be appreciated ... View more

Hi, I'm hoping you can help me I currently have a graph that have 3 events lets call them event1, event2 and event3. I want to somehow in the search total these three values and find out the percentage of each of them for example event1 event2 event3 50 70 20 The searches I have tried so far have not worked I managed to get the total I think but not sure how to find out the percentage of each of the values "index=test| timechart latest(event1) latest(event2) latest(events) | eventstats count AS total" Any help would be much appreciated ... View more