Outputting data with spath in search

[jialiu907]

I am trying to output two rows of data with them being "read" and "write" with both of them having min,max, and avg of some values. Currently I am only able to display one row and I don't know Splunk well enough to use the other set of spath variables to display the other row. 

This is my search and output.

index="collectd_test" plugin=disk type=disk_octets plugin_instance=dm-0
| spath output=values0 path=values{0}
| spath output=values1 path=values{1}
| spath output=dsnames0 path=dsnames{0}
| spath output=dsnames1 path=dsnames{1}
| stats  min(values0) as min max(values0) as max avg(values0) as avg by dsnames0
| eval min=round(min, 2)
| eval max=round(max, 2)
| eval avg=round(avg, 2)

[yuanliu]

When asking a data analytics question, data should be the first thing to describe.  It would help a lot if you can illustrate relevant sample data (anonymize as needed but preserve necessary characteristics) in text to support your implied conclusion that Splunk is not giving you to rows.  How do you convince yourself that dsname0 must have value "write" in addition to "read" that your screenshot shows? (Pro tip: Whenever possible, illustrate result in text as well.)

Ultimately, what are you trying to achieve by spliting values into values0 and values1, dsnames into dsnames0 and dsnames1?  Your stats only uses values0 and dsnames0.  Is it possible that only dsname1 contain the value "write"?

Again, a clear (text) illustration of input data would clarify many of these, and not force volunteers to read your mind.

[jialiu907]

Sorry I was not being clear in my question. The general picture is I am trying to monitor disk usage with events provided through collectd. The events being generated is in JSON format.

I am looking to split Values into values0 and values1, dsnames into dsnames0 and dsnames1 because those are just the names of the index I came up with of the values inside those arrays. Values has the indexes of two numbers and dsnames has the indexes of read and write. I am trying to get the values of both read and write and be able to create aggregate functions with it.

Currently I am only able to show one dsname row, it can be read or write, however, I want to be able to show both.

[yuanliu]

Please illustrate/mock the data.  Without knowing the actual data structure, it is impossible to know the relationship and your true intention.