topic Re: How get a count of last Status in Splunk Search

How get a count of last Status

t_splunk_d — Wed, 02 Aug 2017 01:06:16 GMT

I trying figure out what is the best search query for reporting on the count of different unique status.
Following is the records:
ID NAME STATUS LASTUPDATEDTIME
1 Group1 Started 12:15
1 Group1 Processing 12:30
1 Group1 Transfering 12:45
1 Group1 Completed 1:06
2 Group1 Started 12:17
2 Group1 Processing 12:32
2 Group1 Transfering 12:46
3 Group1 Started 12:55

When I try | stats count by STATUS - it does give me the correct numbers.
I am looking for the result:

Started - 1
Completed - 1
Transferring - 1

I want to report count of last Status.

Thank you.

Re: How get a count of last Status

niketn — Tue, 29 Sep 2020 15:11:23 GMT

@t_splunk_d, | stats count by STATUS should be best way of finding count based on different unique status. Is there any issue that you are facing when you run this command?

Re: How get a count of last Status

adonio — Wed, 02 Aug 2017 09:22:45 GMT

count of last status will always give you 1 if i understand the question correctly...
try the following, considering ID field is ID:
... |stats lastest(STATUS) by ID
hope it helps

Re: How get a count of last Status

gcusello — Wed, 02 Aug 2017 09:27:45 GMT

Hi
let me better understand your request:
each ID can have different status and you want to count only the occurrences of last status of each ID, correct?
If this is your request try something like this:

your_search 
| stats latest(STATUS) AS STATUS by ID 
| stats count by STATUS

Bye.
Giuseppe