Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Set token from specific row & field in a table

$
0
0
Ok, so I'm trying to consolidate some queries and one sticking point is that I've got an ugly base query chased by another doing an appendpipe to give me a summary row. Ideally I'd like it to be one query, however, I need to set tokens from the values in the summary but cannot seem to make that happen outside of the separate query. I know it uses the $result.fieldname$ method and drilldowns use $row.column$. I'm kinda hoping there's a hybrid to specify the row# or last row specifically using the $result.xxx$ style. (If there is, I can 't get the syntax correct...) yadda yadda | appendpipe [ stats sum(fld1) as fld1 sum(fld2) as fld2 | eval fldavg=round(fld1/fld2*100,1)]$result.fld1$$result.fld2$$result.fldavg$

Viewing all articles
Browse latest Browse all 47296

Trending Articles