Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to add a row into a table, the row depends on a search result, which is before the first Pipe (|)?

$
0
0
index="*Value of index*" tag="*Value of Tag*" DATA="*code for data1*" | chart count by parameter1 | rename count as "Count of DATA" | sort - "Count of DATA" As a result, i want to see a table, which display every parameter1 Value, the count of data1 and count of data2 (which isnt in the string within) but both data values seperate. What can I do?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>