topic Re: How to group values in Splunk Search

How to group values

becksyboy — Mon, 09 Nov 2020 17:18:15 GMT

I have a field name called report_name, it can have a number of status values associated with it, i.e. status=a or status=b or status=c etc.

A complete report run would have (status = a & status = b)

A failed report run would have (status = a & status = b & status = c)

How do I group results where (status = a & status = b) = Good and (status = a & status = b & status = c) = Failed for a particular report name?

The issue I'm running into is when a report_name has both (status = a & status = b) & a little while later (status = a & status = b & status = c) I am unable to group them correctly, and end up naming both the same.

thanks

Re: How to group values

somesoni2 — Mon, 09 Nov 2020 20:10:19 GMT

What is the frequency of the report? For your report's timerange, does the the report run once OR multiple times? Is there any other field using which you can uniquely identify a report's execution? If you have a key field OR set of key fields, you'd be able to use `| stats list(status) as statuses ... by key_fields` to get list of status return and then categorize them by that.

Re: How to group values

becksyboy — Tue, 10 Nov 2020 13:53:50 GMT

Thanks for the suggestions, I will investigate to see if there is a unique field.