How to write a search to display data from my database in a statistics table in my dashboard?

[yzimmer]

Hi everybody!

I have got my Database like that :

And I would like to do a "Statistics Table" in my Dashboard like that :

So I would like to :
1) Use only all property who start with the "U" letter
2) Count only when it's different of "null" or "" values

Can you help me ? I am trying to do that but it's so hard for me...
Thanx

[somesoni2]

Give this a try

your base search | table U* | eval temp=1 | untable temp Property value | where isnotnull(value) AND value!="" | stats count by Property

[yzimmer]

Hi Somesoni2!

Thanx for your answer 😉

[sundareshr · Accepted solution]

Try this

your base search | stats count(U*) as U* | transpose | rename column AS Property row1 AS count

[yzimmer]

Thank you a lot to you three!

Sundareshr your answer works perfectly! @somesoni2, your answer works too! Splunk only accepts one accepted answer for the forum, but your two ways work as I want!

Have a good day !

[Richfez]

You may have to modify it slightly to fit your exact needs, but try something like

... PROPERTY=U* | stats count by PROPERTY

Where ... is your other base search filtering, like on index or whatever that gets you your screenshot.

PROPERTY=U* will include only your ones starting with U (which obviously makes the null ones go away). For "empty" values, well, it really depends on exactly what you are doing calculation-wise. Can you confirm they're an actual problem once you do the above, and if so include a few rows that should be not included and what your search is?

[yzimmer]

Hi rich7177! Thanx for your answer!
I tried your code like that but it doesn't work :

* | PROPERTY=U* | stats count by PROPERTY

I also tried to modify it but it doesn't work too :

* | PROPERTY=UD818_APPLICATIONNAME | stats count by PROPERTY

I don't understand why Splunk doesn't want to add the PROPERTY because that works (but this is not what I want...) :

* | stats count by UD818_APPLICATIONNAME

Do you have an other idea?

Thanx a lot!

[Richfez]

No pipe before it. I didn't know your base search so I just put elipses there. To that just add the rest.