https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-write-a-search-to-display-data-from-my-database-in-a/m-p/246253#M27963 <P>Try this</P> <PRE><CODE>your base search | stats count(U*) as U* | transpose | rename column AS Property row1 AS count </CODE></PRE> Thu, 07 Jul 2016 16:37:21 GMT sundareshr 2016-07-07T16:37:21Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-write-a-search-to-display-data-from-my-database-in-a/m-p/246250#M27960 <P>Hi everybody!</P> <P>I have got my Database like that :<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1551i2ABDA256351C1D9A/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>And I would like to do a "Statistics Table" in my Dashboard like that :<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1552i28BA8DEB3170E931/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>So I would like to :<BR /> 1) Use only all property who start with the "U" letter<BR /> 2) Count only when it's different of "null" or "" values</P> <P>Can you help me ? I am trying to do that but it's so hard for me...<BR /> Thanx</P> Thu, 07 Jul 2016 08:48:34 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-write-a-search-to-display-data-from-my-database-in-a/m-p/246250#M27960 yzimmer 2016-07-07T08:48:34Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-write-a-search-to-display-data-from-my-database-in-a/m-p/246251#M27961 <P>You may have to modify it slightly to fit your exact needs, but try something like </P> <PRE><CODE>... PROPERTY=U* | stats count by PROPERTY </CODE></PRE> <P>Where <CODE>...</CODE> is your other base search filtering, like on index or whatever that gets you your screenshot.</P> <P><CODE>PROPERTY=U*</CODE> will include only your ones starting with U (which obviously makes the null ones go away). For "empty" values, well, it really depends on exactly what you are doing calculation-wise. Can you confirm they're an actual problem once you do the above, and if so include a few rows that should be not included and what your search is? </P> Thu, 07 Jul 2016 13:06:28 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-write-a-search-to-display-data-from-my-database-in-a/m-p/246251#M27961 Richfez 2016-07-07T13:06:28Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-write-a-search-to-display-data-from-my-database-in-a/m-p/246252#M27962 <P>Hi rich7177! Thanx for your answer!<BR /> I tried your code like that but it doesn't work :</P> <PRE><CODE>* | PROPERTY=U* | stats count by PROPERTY </CODE></PRE> <P>I also tried to modify it but it doesn't work too :</P> <PRE><CODE>* | PROPERTY=UD818_APPLICATIONNAME | stats count by PROPERTY </CODE></PRE> <P>I don't understand why Splunk doesn't want to add the PROPERTY because that works (but this is not what I want...) :</P> <PRE><CODE>* | stats count by UD818_APPLICATIONNAME </CODE></PRE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1550iF23600E31DD5EBEE/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Do you have an other idea?</P> <P>Thanx a lot!</P> Thu, 07 Jul 2016 13:38:42 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-write-a-search-to-display-data-from-my-database-in-a/m-p/246252#M27962 yzimmer 2016-07-07T13:38:42Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-write-a-search-to-display-data-from-my-database-in-a/m-p/246253#M27963 <P>Try this</P> <PRE><CODE>your base search | stats count(U*) as U* | transpose | rename column AS Property row1 AS count </CODE></PRE> Thu, 07 Jul 2016 16:37:21 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-write-a-search-to-display-data-from-my-database-in-a/m-p/246253#M27963 sundareshr 2016-07-07T16:37:21Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-write-a-search-to-display-data-from-my-database-in-a/m-p/246254#M27964 <P>No pipe before it. I didn't know your base search so I just put elipses there. To that just add the rest.</P> Thu, 07 Jul 2016 17:24:52 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-write-a-search-to-display-data-from-my-database-in-a/m-p/246254#M27964 Richfez 2016-07-07T17:24:52Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-write-a-search-to-display-data-from-my-database-in-a/m-p/246255#M27965 <P>Give this a try</P> <PRE><CODE>your base search | table U* | eval temp=1 | untable temp Property value | where isnotnull(value) AND value!="" | stats count by Property </CODE></PRE> Thu, 07 Jul 2016 18:18:25 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-write-a-search-to-display-data-from-my-database-in-a/m-p/246255#M27965 somesoni2 2016-07-07T18:18:25Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-write-a-search-to-display-data-from-my-database-in-a/m-p/246256#M27966 <P>Thank you a lot to you three!</P> <P>Sundareshr your answer works perfectly! @somesoni2, your answer works too! Splunk only accepts one accepted answer for the forum, but your two ways work as I want!</P> <P>Have a good day !</P> Fri, 08 Jul 2016 08:09:55 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-write-a-search-to-display-data-from-my-database-in-a/m-p/246256#M27966 yzimmer 2016-07-08T08:09:55Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-write-a-search-to-display-data-from-my-database-in-a/m-p/246257#M27967 <P>Hi Somesoni2!</P> <P>Thanx for your answer <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Tue, 12 Jul 2016 08:22:29 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-write-a-search-to-display-data-from-my-database-in-a/m-p/246257#M27967 yzimmer 2016-07-12T08:22:29Z