Archive
Highlighted

Combine Status Results into one Row

Explorer

source="Test" index=XYZ [search source="Test2" index=XYZ2 Address=.| dedup "attachments{}.uniqueid"|rename "attachments{}.uniqueid" as uniqueid|table uniqueid] |dedup uniqueid status|stats count(status) as Documents by status| eval status = case(status=42, "Entered Network", status=200, "Success Email Sent", status=333, "Processing Started", status=400 OR status=500, "Automatic Extraction", status=600 OR status=800, "Entered Validation", status=3, "Others")|eval sortfield=case(status="Entered Network",1,status="Success Email Sent",2,status="Processing Started",3,status="Automatic Extraction",4,status="Entered Validation",5,status="Others",6) | sort by sortfield|table status, Documents

Everything works except I would like to combine Automatic Extraction into one row:

Status Invoices
Entered Network 46
Success Email Sent 46
Processing Started 44
Automatic Extraction 47
Automatic Extraction 42
Entered Validation 56
Others 44

Tags (1)
0 Karma
Highlighted

Re: Combine Status Results into one Row

Explorer

Like --
Status Invoices
Entered Network 46
Success Email Sent 46
Processing Started 44
Automatic Extraction 89
Entered Validation 56
Others 44

0 Karma
Highlighted

Re: Combine Status Results into one Row

Super Champion

you can add a |stats sum(Documents) as Invoices by status at the end. or you could move your |eval status before your stats command.

View solution in original post

0 Karma
Highlighted

Re: Combine Status Results into one Row

Explorer

Thanks. That was simple... I feel like an idiot 😉

0 Karma
Highlighted

Re: Combine Status Results into one Row

Super Champion

you have no idea how easy it is to overlook the simplest things 🙂

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.