Splunk Search

how to combine two columns values based

snam
New Member

Hi,
I have a table like below

Name Percentage1 Percentage2
T1 25

T1 56
T2 34

T2 59

And I need a result like below

Name Percentage1 Percentage2
T1 25 56
T2 34 59

could anyone please let me know how do I achieve that in splunk?

0 Karma

dineshraj9
Builder

Considering your search returns 3 columns - Name, Percentage1, Percentage2 and each Name has only values Percentage1 and Percentage2 repeated, you can add the below to your query and achieve desired results -

| stats list(Percentage1) as Percentage1 by Name
| eval Percentage2=mvindex(Percentage1,1)
| eval Percentage1=mvindex(Percentage1,0)
0 Karma

adonio
Ultra Champion

hello there,
from your example it seems to me that there are no values to Percentage2 (but maybe i dont understand in full)
is that correct?
can you kindly share your search and some sample data?

0 Karma

lloydknight
Builder

may we see your search query?

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...