topic Re: Grouping result after stats in Splunk Search

Grouping result after stats

SplunkBaby — Mon, 17 Mar 2014 10:44:20 GMT

Hi
I have a search like this
host=A |stats last("Status") by TaskId

I like to group the result of above query by Status and then display a pie chart.
I use transaction "Status" but doesn't work out.
Can anybody help me.

Re: Grouping result after stats

Rocket66 — Mon, 17 Mar 2014 11:09:21 GMT

Don't know, what the problem is ...

do you get no results (as a list)?
you get results but, the pie chart is rendered with wrong or no values?

Maybe your field "Status" is called "status" or "TaskId", "TaskID" or some (other) typo?

Greetz, Robert

Re: Grouping result after stats

richgalloway — Mon, 17 Mar 2014 11:29:20 GMT

In addition to Rocket66's comment, try this: 'host=A | stats last("Status") as LastStatus by TaskId | chart LastStatus'.

Re: Grouping result after stats

SplunkBaby — Mon, 17 Mar 2014 11:48:44 GMT

I get the result.Result is based on TaskIds.
I want to group that result again based on Status.
for that i use like
host=A |stats last("Status") by TaskId | transaction "Status".
This is not working.How can i achieve this.

Re: Grouping result after stats

SplunkBaby — Mon, 17 Mar 2014 12:23:43 GMT

This worked out .Thanks man

Re: Grouping result after stats

SplunkBaby — Mon, 17 Mar 2014 12:24:20 GMT

Thanks it is solved

Re: Grouping result after stats

richgalloway — Mon, 17 Mar 2014 12:29:20 GMT

Please accept the answer if it is what got it worked out.