I am trying to output two rows of data with them being "read" and "write" with both of them having min,max, and avg of some values. Currently I am only able to display one row and I don't know Splunk well enough to use the other set of spath variables to display the other row.  This is my search and output. index="collectd_test" plugin=disk type=disk_octets plugin_instance=dm-0 | spath output=values0 path=values{0} | spath output=values1 path=values{1} | spath output=dsnames0 path=dsnames{0} | spath output=dsnames1 path=dsnames{1} | stats min(values0) as min max(values0) as max avg(values0) as avg by dsnames0 | eval min=round(min, 2) | eval max=round(max, 2) | eval avg=round(avg, 2)             ... View more

I am looking to extract some information from a Values field that has two values within it.  How can i specify which one of the values I need in a search as the two values is meant to be "read" and "written"? This is my current search right now and I think it is including both values together. index="collectd_test" plugin=disk type=disk_octets plugin_instance=$plugin_instance1$ | stats min(value) as min max(value) as max avg(value) as avg | eval min=round(min, 2) | eval max=round(max, 2) | eval avg=round(avg, 2) ... View more

I am currently trying to join two search queries together through the appendcols command in order to display two lines of data in a line graph. I am running across a error through the search that is being appended, that it is displaying the wrong data. This is the current search with appendcols added.   index=main host=* sourcetype=syslog process=elcsend "\"config " CentOS | rex "([^!]*!){2}(?P<type>[^!]*)!([^!]*!){4}(?P<role>[^!]*)!([^!]*!){23}(?P<vers>[^!]*)" | search role=std-dhcp | eval Total=sum(host) | timechart span=1d count by Total | rename NULL as CentOS | appendcols override=true [search index=os source=ps host=deml* OR host=sefs* OR host=ingg* OR host=us* OR host=gblc* NOT user=dcv NOT user=root NOT user=chrony NOT user=dbus NOT user=gdm NOT user=libstor+ NOT user=nslcd NOT user=polkitd NOT user=postfix NOT user=rpc NOT user=rpcuser NOT user=rtkit NOT user=colord NOT user=nobody NOT user=sgeadmin NOT user=splunk NOT user=setroub+ NOT user=lp NOT user=68 NOT user=ntp NOT user=smmsp NOT user=dcvsmagent NOT user=libstoragemgmt | timechart span=1d dc(user) as DCV]   This is the current result. DCV(furthest right) is displaying the wrong count as when the search is ran by itself, it shows around 300 and now once appended, it is only displaying 112 give or take. It is also not displaying over the period of days and only on the most recent day. I am not sure if something is wrong in the search itself or something to do with the fields overlapping.    ... View more

I am looking to display only one statistic row being named Total with the count of all of the hosts added up, which should equal around 450, give or take. I know how to add it up in the way of using addcoltotals but I am only looking for the Total row, excluding the rest of the stats. I have attached the base search and the current output.  index=os source=ps host=deml* OR host=sefs* OR host=ingg* OR host=us* OR host=gblc* NOT user=dcv NOT user=root NOT user=chrony NOT user=dbus NOT user=gdm NOT user=libstor+ NOT user=nslcd NOT user=polkitd NOT user=postfix NOT user=rpc NOT user=rpcuser NOT user=rtkit NOT user=colord NOT user=nobody NOT user=sgeadmin NOT user=splunk NOT user=setroub+ NOT user=lp NOT user=68 NOT user=ntp NOT user=smmsp NOT user=dcvsmagent NOT user=libstoragemgmt | dedup user | stats count by host   ... View more