topic Need help on a query in Splunk Search

topic Need help on a query in Splunk Search https://community.splunk.com/t5/Splunk-Search/Need-help-on-a-query/m-p/682670#M233208 <P> </P><LI-CODE lang="markup">|msats sum(count-error) as Failed where index=metrics_index by service errorNumber errortype</LI-CODE><P> </P><P>Results:</P><TABLE width="281"><TBODY><TR><TD width="64">service</TD><TD width="89">errorNumber</TD><TD width="64">errortype</TD><TD width="64">Failed</TD></TR><TR><TD>aaca</TD><TD>0</TD><TD>fail</TD><TD>8</TD></TR><TR><TD>aaca</TD><TD>10</TD><TD>pass</TD><TD>1000</TD></TR><TR><TD>aaca</TD><TD>25</TD><TD>fail</TD><TD>290</TD></TR><TR><TD>aaca</TD><TD>120</TD><TD>fail</TD><TD>8</TD></TR><TR><TD>aaca</TD><TD>80</TD><TD>pass</TD><TD>800</TD></TR><TR><TD>aaca</TD><TD>200</TD><TD>fail</TD><TD>400</TD></TR><TR><TD>aaca</TD><TD>210</TD><TD>pass</TD><TD>22</TD></TR><TR><TD>aaca</TD><TD>500</TD><TD>fail</TD><TD>10</TD></TR><TR><TD>aaw</TD><TD>120</TD><TD>fail</TD><TD>8</TD></TR><TR><TD>aaw</TD><TD>80</TD><TD>pass</TD><TD>2000</TD></TR><TR><TD>aaw</TD><TD>200</TD><TD>fail</TD><TD>3</TD></TR><TR><TD>aaw</TD><TD>210</TD><TD>pass</TD><TD>56</TD></TR><TR><TD>aaw</TD><TD>500</TD><TD>fail</TD><TD>22</TD></TR><TR><TD>aaw</TD><TD>0</TD><TD>pass</TD><TD>0</TD></TR><TR><TD>www</TD><TD>0</TD><TD>fail</TD><TD>8</TD></TR><TR><TD>www</TD><TD>10</TD><TD>pass</TD><TD>1000</TD></TR><TR><TD>www</TD><TD>25</TD><TD>fail</TD><TD>290</TD></TR><TR><TD>www</TD><TD>120</TD><TD>fail</TD><TD>8</TD></TR><TR><TD>www</TD><TD>80</TD><TD>pass</TD><TD>800</TD></TR><TR><TD>www</TD><TD>200</TD><TD>fail</TD><TD>400</TD></TR><TR><TD>amb</TD><TD>500</TD><TD>fail</TD><TD>10</TD></TR><TR><TD>amb</TD><TD>120</TD><TD>fail</TD><TD>8</TD></TR><TR><TD>amb</TD><TD>80</TD><TD>pass</TD><TD>2000</TD></TR><TR><TD>amb</TD><TD>200</TD><TD>fail</TD><TD>3</TD></TR><TR><TD>amb</TD><TD>210</TD><TD>pass</TD><TD>56</TD></TR><TR><TD>amb</TD><TD>500</TD><TD>fail</TD><TD>22</TD></TR><TR><TD>amb</TD><TD>0</TD><TD>pass</TD><TD>0</TD></TR><TR><TD>asf</TD><TD>0</TD><TD>fail</TD><TD>8</TD></TR><TR><TD>asf</TD><TD>10</TD><TD>pass</TD><TD>1000</TD></TR><TR><TD>asf</TD><TD>0</TD><TD>pass</TD><TD>0</TD></TR><TR><TD>asf</TD><TD>0</TD><TD>fail</TD><TD>8</TD></TR><TR><TD>asf</TD><TD>10</TD><TD>pass</TD><TD>1000</TD></TR></TBODY></TABLE><P><BR /><BR />But we want the output as shown below:<BR />We need only top 4 errornumber show up along with the failed count</P><TABLE width="281"><TBODY><TR><TD width="64">service</TD><TD width="89">errorNumber</TD><TD width="64">errortype</TD><TD width="64">Failed</TD></TR><TR><TD width="64">aaca</TD><TD>0</TD><TD>fail</TD><TD>2538</TD></TR><TR><TD>10</TD><TD>pass</TD></TR><TR><TD>25</TD><TD>fail</TD></TR><TR><TD>120</TD><TD>fail</TD></TR><TR><TD>80</TD><TD>pass</TD></TR><TR><TD>200</TD><TD>fail</TD></TR><TR><TD>210</TD><TD>pass</TD></TR><TR><TD>500</TD><TD>fail</TD></TR><TR><TD>aaw</TD><TD>120</TD><TD>fail</TD><TD>2089</TD></TR><TR><TD>80</TD><TD>pass</TD></TR><TR><TD>200</TD><TD>fail</TD></TR><TR><TD>210</TD><TD>pass</TD></TR><TR><TD>500</TD><TD>fail</TD></TR><TR><TD>0</TD><TD>pass</TD></TR><TR><TD>www</TD><TD>0</TD><TD>fail</TD><TD>2506</TD></TR><TR><TD>10</TD><TD>pass</TD></TR><TR><TD>25</TD><TD>fail</TD></TR><TR><TD>120</TD><TD>fail</TD></TR><TR><TD>80</TD><TD>pass</TD></TR><TR><TD>200</TD><TD>fail</TD></TR><TR><TD>amb</TD><TD>500</TD><TD>fail</TD><TD>2099</TD></TR><TR><TD>120</TD><TD>fail</TD></TR><TR><TD>80</TD><TD>pass</TD></TR><TR><TD>200</TD><TD>fail</TD></TR><TR><TD>210</TD><TD>pass</TD></TR><TR><TD>500</TD><TD>fail</TD></TR><TR><TD>0</TD><TD>pass</TD></TR><TR><TD>asf</TD><TD>0</TD><TD>fail</TD><TD>2016</TD></TR><TR><TD>10</TD><TD>pass</TD></TR><TR><TD>0</TD><TD>pass</TD></TR><TR><TD>0</TD><TD>fail</TD></TR><TR><TD>10</TD><TD>pass</TD></TR></TBODY></TABLE><P> </P> Tue, 02 Apr 2024 00:31:05 GMT mahesh27 2024-04-02T00:31:05Z Need help on a query https://community.splunk.com/t5/Splunk-Search/Need-help-on-a-query/m-p/682670#M233208 <P> </P><LI-CODE lang="markup">|msats sum(count-error) as Failed where index=metrics_index by service errorNumber errortype</LI-CODE><P> </P><P>Results:</P><TABLE width="281"><TBODY><TR><TD width="64">service</TD><TD width="89">errorNumber</TD><TD width="64">errortype</TD><TD width="64">Failed</TD></TR><TR><TD>aaca</TD><TD>0</TD><TD>fail</TD><TD>8</TD></TR><TR><TD>aaca</TD><TD>10</TD><TD>pass</TD><TD>1000</TD></TR><TR><TD>aaca</TD><TD>25</TD><TD>fail</TD><TD>290</TD></TR><TR><TD>aaca</TD><TD>120</TD><TD>fail</TD><TD>8</TD></TR><TR><TD>aaca</TD><TD>80</TD><TD>pass</TD><TD>800</TD></TR><TR><TD>aaca</TD><TD>200</TD><TD>fail</TD><TD>400</TD></TR><TR><TD>aaca</TD><TD>210</TD><TD>pass</TD><TD>22</TD></TR><TR><TD>aaca</TD><TD>500</TD><TD>fail</TD><TD>10</TD></TR><TR><TD>aaw</TD><TD>120</TD><TD>fail</TD><TD>8</TD></TR><TR><TD>aaw</TD><TD>80</TD><TD>pass</TD><TD>2000</TD></TR><TR><TD>aaw</TD><TD>200</TD><TD>fail</TD><TD>3</TD></TR><TR><TD>aaw</TD><TD>210</TD><TD>pass</TD><TD>56</TD></TR><TR><TD>aaw</TD><TD>500</TD><TD>fail</TD><TD>22</TD></TR><TR><TD>aaw</TD><TD>0</TD><TD>pass</TD><TD>0</TD></TR><TR><TD>www</TD><TD>0</TD><TD>fail</TD><TD>8</TD></TR><TR><TD>www</TD><TD>10</TD><TD>pass</TD><TD>1000</TD></TR><TR><TD>www</TD><TD>25</TD><TD>fail</TD><TD>290</TD></TR><TR><TD>www</TD><TD>120</TD><TD>fail</TD><TD>8</TD></TR><TR><TD>www</TD><TD>80</TD><TD>pass</TD><TD>800</TD></TR><TR><TD>www</TD><TD>200</TD><TD>fail</TD><TD>400</TD></TR><TR><TD>amb</TD><TD>500</TD><TD>fail</TD><TD>10</TD></TR><TR><TD>amb</TD><TD>120</TD><TD>fail</TD><TD>8</TD></TR><TR><TD>amb</TD><TD>80</TD><TD>pass</TD><TD>2000</TD></TR><TR><TD>amb</TD><TD>200</TD><TD>fail</TD><TD>3</TD></TR><TR><TD>amb</TD><TD>210</TD><TD>pass</TD><TD>56</TD></TR><TR><TD>amb</TD><TD>500</TD><TD>fail</TD><TD>22</TD></TR><TR><TD>amb</TD><TD>0</TD><TD>pass</TD><TD>0</TD></TR><TR><TD>asf</TD><TD>0</TD><TD>fail</TD><TD>8</TD></TR><TR><TD>asf</TD><TD>10</TD><TD>pass</TD><TD>1000</TD></TR><TR><TD>asf</TD><TD>0</TD><TD>pass</TD><TD>0</TD></TR><TR><TD>asf</TD><TD>0</TD><TD>fail</TD><TD>8</TD></TR><TR><TD>asf</TD><TD>10</TD><TD>pass</TD><TD>1000</TD></TR></TBODY></TABLE><P><BR /><BR />But we want the output as shown below:<BR />We need only top 4 errornumber show up along with the failed count</P><TABLE width="281"><TBODY><TR><TD width="64">service</TD><TD width="89">errorNumber</TD><TD width="64">errortype</TD><TD width="64">Failed</TD></TR><TR><TD width="64">aaca</TD><TD>0</TD><TD>fail</TD><TD>2538</TD></TR><TR><TD>10</TD><TD>pass</TD></TR><TR><TD>25</TD><TD>fail</TD></TR><TR><TD>120</TD><TD>fail</TD></TR><TR><TD>80</TD><TD>pass</TD></TR><TR><TD>200</TD><TD>fail</TD></TR><TR><TD>210</TD><TD>pass</TD></TR><TR><TD>500</TD><TD>fail</TD></TR><TR><TD>aaw</TD><TD>120</TD><TD>fail</TD><TD>2089</TD></TR><TR><TD>80</TD><TD>pass</TD></TR><TR><TD>200</TD><TD>fail</TD></TR><TR><TD>210</TD><TD>pass</TD></TR><TR><TD>500</TD><TD>fail</TD></TR><TR><TD>0</TD><TD>pass</TD></TR><TR><TD>www</TD><TD>0</TD><TD>fail</TD><TD>2506</TD></TR><TR><TD>10</TD><TD>pass</TD></TR><TR><TD>25</TD><TD>fail</TD></TR><TR><TD>120</TD><TD>fail</TD></TR><TR><TD>80</TD><TD>pass</TD></TR><TR><TD>200</TD><TD>fail</TD></TR><TR><TD>amb</TD><TD>500</TD><TD>fail</TD><TD>2099</TD></TR><TR><TD>120</TD><TD>fail</TD></TR><TR><TD>80</TD><TD>pass</TD></TR><TR><TD>200</TD><TD>fail</TD></TR><TR><TD>210</TD><TD>pass</TD></TR><TR><TD>500</TD><TD>fail</TD></TR><TR><TD>0</TD><TD>pass</TD></TR><TR><TD>asf</TD><TD>0</TD><TD>fail</TD><TD>2016</TD></TR><TR><TD>10</TD><TD>pass</TD></TR><TR><TD>0</TD><TD>pass</TD></TR><TR><TD>0</TD><TD>fail</TD></TR><TR><TD>10</TD><TD>pass</TD></TR></TBODY></TABLE><P> </P> Tue, 02 Apr 2024 00:31:05 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-on-a-query/m-p/682670#M233208 mahesh27 2024-04-02T00:31:05Z Re: Need help on a query https://community.splunk.com/t5/Splunk-Search/Need-help-on-a-query/m-p/682952#M233272 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/249143">@mahesh27</a>,</P><P>You can filter results like below;</P><LI-CODE lang="markup">| mstats sum(count-error) as Failed where index=metrics_index by service errorNumber errortype | sort 4 - Failed</LI-CODE><P> </P><P> </P> Wed, 03 Apr 2024 04:43:17 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-on-a-query/m-p/682952#M233272 scelikok 2024-04-03T04:43:17Z Re: Need help on a query https://community.splunk.com/t5/Splunk-Search/Need-help-on-a-query/m-p/683001#M233283 <P>Either your table is misaligned or you're trying to do something very non-obvious.</P><P>I don't understand what is the relation beetween this:</P><TABLE width="281"><TBODY><TR><TD width="64">service</TD><TD width="89">errorNumber</TD><TD width="64">errortype</TD><TD width="64">Failed</TD></TR><TR><TD>aaca</TD><TD>0</TD><TD>fail</TD><TD>8</TD></TR><TR><TD>aaca</TD><TD>10</TD><TD>pass</TD><TD>1000</TD></TR><TR><TD>aaca</TD><TD>25</TD><TD>fail</TD><TD>290</TD></TR><TR><TD>aaca</TD><TD>120</TD><TD>fail</TD><TD>8</TD></TR><TR><TD>aaca</TD><TD>80</TD><TD>pass</TD><TD>800</TD></TR><TR><TD>aaca</TD><TD>200</TD><TD>fail</TD><TD>400</TD></TR><TR><TD>aaca</TD><TD>210</TD><TD>pass</TD><TD>22</TD></TR><TR><TD>aaca</TD><TD>500</TD><TD>fail</TD><TD>10</TD></TR></TBODY></TABLE><P>And this:</P><TABLE width="281"><TBODY><TR><TD width="64">service</TD><TD width="89">errorNumber</TD><TD width="64">errortype</TD><TD width="64">Failed</TD></TR><TR><TD width="64">aaca</TD><TD>0</TD><TD>fail</TD><TD>2538</TD></TR><TR><TD>10</TD><TD>pass</TD></TR><TR><TD>25</TD><TD>fail</TD></TR><TR><TD>120</TD><TD>fail</TD></TR><TR><TD>80</TD><TD>pass</TD></TR><TR><TD>200</TD><TD>fail</TD></TR><TR><TD>210</TD><TD>pass</TD></TR><TR><TD>500</TD><TD>fail</TD></TR></TBODY></TABLE><P> </P><P>Also remember that Splunk is not Excel so you can't merge cells</P> Wed, 03 Apr 2024 10:21:45 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-on-a-query/m-p/683001#M233283 PickleRick 2024-04-03T10:21:45Z