Splunk Search

Merge multipel events

ivanlesk
Engager

Hi,
I have something like this.

    ID    date(month)  avgValue1  avgValue2   avgValue3   ...
    111   2016-06      value      value       value       ...
    111   2016-07      value      value       value       ...
    222   2016-01      value      value       value       ...
    222   2016-03      value      value       value       ...
    ...   ...          ...        ...         ...         ...

I basically have two event per ID (event for month before and event for month after)
I would like to join/merge that in one event that would look something like this:

ID   avgValue1_before   avgValue1_after   avgValue2_before   avgValue2_after ...
111  value              value             value              value           ...
222  value              value             value              value           ...

Is this somehow possible?

Tags (2)
0 Karma
1 Solution

cmerriman
Super Champion
...|sort 0 + ID + "date(month)"|streamstats count by ID "date(month)"|eval beforeAfter=if(count==1,"before","after")|chart values(avgValue1) as avgValue1 values(avgValue2) as avgValue2 by ID beforeAfter

try something like this.

View solution in original post

0 Karma

cmerriman
Super Champion
...|sort 0 + ID + "date(month)"|streamstats count by ID "date(month)"|eval beforeAfter=if(count==1,"before","after")|chart values(avgValue1) as avgValue1 values(avgValue2) as avgValue2 by ID beforeAfter

try something like this.

0 Karma

ivanlesk
Engager
...|sort 0 + ID + "date(month)"|streamstats count by ID "date(month)"

should be without "date(month)" (if you count it by id and date count is allways =1)

But apart from that, it works. Thx

0 Karma

cmerriman
Super Champion

good call!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...