Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to create a table of eval fields along with stats

$
0
0
I have a query where I eval 3 fields by substracting different timestamps eval Field1 = TS1-TS2 eval Field2 = TS3-TS4 eval Field3 = TS5- TS6 eval Date = strftime(_time, "%m-%d-%Y") Next I use the stats command to calculate count, min,max,average for these 3 evaluated Fields by date. If use stats count(Field1), count(Field2),count(Field3) by Date then I end up with all the values in same row. How can i get these stats for each Fields in different line ? i.e my out put should look like : Date,Fields,Min,Max,Avg 10/2/2017, Field1,5,10,8 10/2/2017, Field2,15,110,30 10/2/2017, Field3,11,102,58 10/3/2017, Field1,15,110,28 10/3/2017, Field2,25,210,100 10/3/2017, Field3,12,110,60

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>