I have performance data captured with Splunk with fields and data like this:
I need to turn this into a table with the columns: Name,Latest,Max(last 24h),Average
How can I use stats to create the same columns for these different fields? And group them each into a row?
asked 25 Mar '11, 16:49
Here's one approach.
For simplicity, this assumes that your max is calculated over the same time period as your reporting range. It pulls everything into field values rather than field names, since
If your intent was to have the 'Max' value for only the last 24 hours, regardless of the overall search time window, you can mask out the older values:
answered 26 Mar '11, 01:26