Splunk Search

how to combine two columns values based

snam
New Member

Hi,
I have a table like below

Name Percentage1 Percentage2
T1 25

T1 56
T2 34

T2 59

And I need a result like below

Name Percentage1 Percentage2
T1 25 56
T2 34 59

could anyone please let me know how do I achieve that in splunk?

0 Karma

dineshraj9
Builder

Considering your search returns 3 columns - Name, Percentage1, Percentage2 and each Name has only values Percentage1 and Percentage2 repeated, you can add the below to your query and achieve desired results -

| stats list(Percentage1) as Percentage1 by Name
| eval Percentage2=mvindex(Percentage1,1)
| eval Percentage1=mvindex(Percentage1,0)
0 Karma

adonio
Ultra Champion

hello there,
from your example it seems to me that there are no values to Percentage2 (but maybe i dont understand in full)
is that correct?
can you kindly share your search and some sample data?

0 Karma

lloydknight
Builder

may we see your search query?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...