Is there a way to combine the following the following result into one line?
Current Result:
q2.example.com 26,575.24
q2.example.com 595.89 MB
1p.example.com 12,911.08
1p.example.com 218.39 MB
Expected Result:
q2.example.com 26,575.24 595.89 MB
1p.example.com 12,911.08 218.39 MB
Sample data:
11/13/2015 21:04:42 Total number of bytes transferred: 44,745.47 KB/sec
11/14/2015 21:20:57 Total number of bytes transferred: 42,745.47 KB/sec
11/13/2015 21:04:42 Aggregate data transfer rate: 242.22 MB
11/14/2015 21:20:57 Aggregate data transfer rate: 145.39 MB
Links I visited and tried:
https://answers.splunk.com/answers/58845/multiple-searches-in-one-chart.html
https://answers.splunk.com/answers/40165/merge-two-search-results.html
Search:
index=os_linux earliest=-1d ("Aggregate data transfer rate" OR "Total number of bytes transferred") | rex field=_raw "Aggregate data transfer rate: (?<AggregateTransfer>.*)KB\/sec" | rex field=_raw "Total number of bytes transferred: (?<TotalTransfer>.*)" | table host, AggregateTransfer,TotalTransfer
You could do a transaction, though the performance isn't great.
... | transaction host
Try this
index=os_linux earliest=-1d "Aggregate" OR "Total"| rex "e:\s+(?<AggregateTransfer>[\d,\.]+)" | rex "d:\s+(?<TotalTransfer>[\d,\.]+)"| timechart span=1d sum(AggregateTransfer) as Agg sum(TotalTransfer) as Total | fields - _time
sundareshr,
I don't mean to do a sum, just put all the same fields in one line (See current and expected result).
I think jluo got it.
You could do a transaction, though the performance isn't great.
... | transaction host
Thanks Jluo!