Splunk Search

how to combine two columns values based

snam
New Member

Hi,
I have a table like below

Name Percentage1 Percentage2
T1 25

T1 56
T2 34

T2 59

And I need a result like below

Name Percentage1 Percentage2
T1 25 56
T2 34 59

could anyone please let me know how do I achieve that in splunk?

0 Karma

dineshraj9
Builder

Considering your search returns 3 columns - Name, Percentage1, Percentage2 and each Name has only values Percentage1 and Percentage2 repeated, you can add the below to your query and achieve desired results -

| stats list(Percentage1) as Percentage1 by Name
| eval Percentage2=mvindex(Percentage1,1)
| eval Percentage1=mvindex(Percentage1,0)
0 Karma

adonio
Ultra Champion

hello there,
from your example it seems to me that there are no values to Percentage2 (but maybe i dont understand in full)
is that correct?
can you kindly share your search and some sample data?

0 Karma

lloydknight
Builder

may we see your search query?

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...