Splunk Search

How to edit my search to combine results to make multiple rows?

RogueMrSmith
Engager

Hello Everyone,

With my current search I am able to display results in three rows, however, I need two of the rows to combine as multiple rows with populated results. For example, here's what I am getting

Name - Type - AVG
1 - -------foo----3
1----------bar--0.2
1---------cake--0.2
2----------foo--7
2----------bar--2
2----------cake--6

But what I actually need is:

NAME FOO BAR CAKE
1---------3-----0.2----0.2
2---------7-----2------6

Is there anyway to do this? Here is my search.

| rename "(002) Device.FullyQualifiedDomainName.nvarchar" AS Name |rename "(003) PerformanceAnalysisDataDiskCounter.Value.float" AS val | rename "(001) PerformanceAnalysisCounter.CounterResourceName.nvarchar" AS type|stats avg(val) as ven by Name, type| stats list(ven) AS average by Name,type
0 Karma
1 Solution

somesoni2
Revered Legend

You can replace your stats with chart command. Like this

| rename "(002) Device.FullyQualifiedDomainName.nvarchar" AS Name |rename "(003) PerformanceAnalysisDataDiskCounter.Value.float" AS val | rename "(001) PerformanceAnalysisCounter.CounterResourceName.nvarchar" AS type|stats avg(val) as ven by Name, type| chart list(ven) AS average by Name,type

View solution in original post

somesoni2
Revered Legend

You can replace your stats with chart command. Like this

| rename "(002) Device.FullyQualifiedDomainName.nvarchar" AS Name |rename "(003) PerformanceAnalysisDataDiskCounter.Value.float" AS val | rename "(001) PerformanceAnalysisCounter.CounterResourceName.nvarchar" AS type|stats avg(val) as ven by Name, type| chart list(ven) AS average by Name,type

RogueMrSmith
Engager

Thanks! That did exactly what I needed!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...