https://community.splunk.com/t5/Splunk-Search/chart-count-over-in-splunk/m-p/342321#M101413 <PRE><CODE>| rest /services/authentication/users splunk_server=local | search [| rest /services/authentication/current-context | rename username as title | fields title] |fields realname |map[|inputlookup mpc.csv |chart count over "Sub Division 4" by "Enrollment Status" | eval Enrolled=if(isnotnull(Enrolled),Enrolled,0) | eval In-Progress=if(isnotnull('In-Progress'),'In-Progress',0) |eval Completed=if(isnotnull(Completed),Completed,0)| eval total='Completed'+'Enrolled'+'In-Progress' |eval %Completed=round(('Completed'/('total'))*100,2) |eval %Enrolled=round((Enrolled/('total'))*100,2)|eval "%In-Progress"=round(('In-Progress'/('total'))*100,2) |rename total as "Total Employee Count" "Sub Division 4" as "Business Area"| fields "Business Area" "Supervisor Name" "Total Employee Count" %Enrolled "%In-Progress" %Completed] </CODE></PRE> <P>Currently am using above query which is showing me all the enrollment status values by business area but in addition to that i want to search the realname in the mpc.csv file in the column "supervisor Name" and display it.<BR /> how to do that ?</P> Thu, 08 Mar 2018 18:14:23 GMT surekhasplunk 2018-03-08T18:14:23Z https://community.splunk.com/t5/Splunk-Search/chart-count-over-in-splunk/m-p/342321#M101413 <PRE><CODE>| rest /services/authentication/users splunk_server=local | search [| rest /services/authentication/current-context | rename username as title | fields title] |fields realname |map[|inputlookup mpc.csv |chart count over "Sub Division 4" by "Enrollment Status" | eval Enrolled=if(isnotnull(Enrolled),Enrolled,0) | eval In-Progress=if(isnotnull('In-Progress'),'In-Progress',0) |eval Completed=if(isnotnull(Completed),Completed,0)| eval total='Completed'+'Enrolled'+'In-Progress' |eval %Completed=round(('Completed'/('total'))*100,2) |eval %Enrolled=round((Enrolled/('total'))*100,2)|eval "%In-Progress"=round(('In-Progress'/('total'))*100,2) |rename total as "Total Employee Count" "Sub Division 4" as "Business Area"| fields "Business Area" "Supervisor Name" "Total Employee Count" %Enrolled "%In-Progress" %Completed] </CODE></PRE> <P>Currently am using above query which is showing me all the enrollment status values by business area but in addition to that i want to search the realname in the mpc.csv file in the column "supervisor Name" and display it.<BR /> how to do that ?</P> Thu, 08 Mar 2018 18:14:23 GMT https://community.splunk.com/t5/Splunk-Search/chart-count-over-in-splunk/m-p/342321#M101413 surekhasplunk 2018-03-08T18:14:23Z https://community.splunk.com/t5/Splunk-Search/chart-count-over-in-splunk/m-p/342322#M101414 <P>Try like this</P> <PRE><CODE>|inputlookup mpc.csv | where 'Supervisor Name'=[| rest /services/authentication/current-context splunk_server=local | table realname | rename realname as search | format] | eval "Sub Division 4"='Sub Division 4'."##".'Supervisor Name' |chart count over "Sub Division 4" by "Enrollment Status" | eval Enrolled=if(isnotnull(Enrolled),Enrolled,0) | eval In-Progress=if(isnotnull('In-Progress'),'In-Progress',0) |eval Completed=if(isnotnull(Completed),Completed,0) | eval total='Completed'+'Enrolled'+'In-Progress' |eval %Completed=round(('Completed'/('total'))*100,2) |eval %Enrolled=round((Enrolled/('total'))*100,2)|eval "%In-Progress"=round(('In-Progress'/('total'))*100,2) | rex field="Sub Division 4" "(?&lt;SubDiv&gt;[^#]+)##(?&lt;Supervisor&gt;.+)" |rename total as "Total Employee Count" "SubDiv" as "Business Area" Supervisor as "Supervisor Name"| fields "Business Area" "Supervisor Name" "Total Employee Count" %Enrolled "%In-Progress" %Completed </CODE></PRE> Thu, 08 Mar 2018 18:53:17 GMT https://community.splunk.com/t5/Splunk-Search/chart-count-over-in-splunk/m-p/342322#M101414 somesoni2 2018-03-08T18:53:17Z