topic Re: stats count by multiple values with conditions in Splunk Search

stats count by multiple values with conditions

ashishv — Wed, 27 Nov 2013 19:11:19 GMT

Hello All,

i have the following query with results:

Query:
index=X1 OR index=X2 OR index=X3 OR index=X4| stats count by result_action

result_action count

Failure 356
Success 591
Failure with condition1 5
Success with condition1 58088
Check Resource 47245
Data Store Error 4
Read User Properties 7381
User Token Created 38737
User Token Failed 77818

I would like to collapse all result_actions and group them as follows.

Success= value
Failure=value
Total=Value

Could anyone help here

Thanks
Ashish

Re: stats count by multiple values with conditions

lukejadamec — Wed, 27 Nov 2013 19:14:08 GMT

Which fields are you counting as failures, and which are successes?

Re: stats count by multiple values with conditions

delink — Wed, 27 Nov 2013 19:18:16 GMT

The easiest thing to do here would be to create tags for each value with your desired groups above. Setting the tag "success" on result_action="Success with condition" and so on.

You could then write a search like:



index=X1 OR index=X2 OR index=X3 OR index=X4| stats count by tag::result_action

Hope that helps!

Re: stats count by multiple values with conditions

ashishv — Mon, 28 Sep 2020 15:22:53 GMT

if there is a Fail in result_action it is a FAILED & if Succ in result_action it is a SUCCESS.

thnx

Re: stats count by multiple values with conditions

ashishv — Wed, 27 Nov 2013 19:24:51 GMT

this didnt work i got a "No result found"

Re: stats count by multiple values with conditions

delink — Wed, 27 Nov 2013 19:34:43 GMT

Did you go through and add all of the tags on various values of result_action? I was able to run a command like this on my own Splunk instance and count results by tags rather than the original values.

Re: stats count by multiple values with conditions

ashishv — Wed, 27 Nov 2013 19:36:10 GMT

Sorry, newbie here… not sure how to add Tags.

Re: stats count by multiple values with conditions

delink — Mon, 28 Sep 2020 15:22:58 GMT

No problem at all. In the search interface, you will want to go into the field picker and make result_action a selected field. It will then show up under each event in the search results. From there, you can click on the result_action=value in an event and you will see a Tag option there. Just add "success" or "failure" for each of the possible result_action values, then the search provided above will work.

Re: stats count by multiple values with conditions

ashishv — Wed, 27 Nov 2013 19:58:50 GMT

Yep that worked, thnx…

Ashish

Re: stats count by multiple values with conditions

delink — Wed, 27 Nov 2013 20:00:21 GMT

Excellent. If you wouldn't mind voting up the answer and selecting it as the correct answer, I would appreciate it.