Splunk Search

Splitting stats count results into 2 sepereate Columns

nic28
New Member

hi can someone please help me with this, ive been trying and searching but no luck. i want to split the "Delivered" field into 2 and stats count on each field.
ideally i want it to look like the below, so there will be the total count and then what makes up the total count should be split

Count| True| False
100 80 20

my search | mcType=delivery Dir=Inbound Sender="*" | chart sparkline count by "Sender" | sort count desc

hope it makes sense

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi nic28,
you should share more information about your request.
Anyway you should try something like this

your_search
| stats count by Delivered
| addcoltotals labelfield=Delivered label=Total
| transpose header_field=Delivered
| fields - column

Bye.
Giuseppe

0 Karma

nic28
New Member

hi cusello , so that didn't do exactly what I wanted for this search, however that will be handy for another I need to do. this was actually a simple fix to my original search I just included "Delivered"
|chart sparkline count by "Sender", Delivered |and it gave me what I wanted. sorry for the half info, still new to this. thanks again

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @nic28,

Please try below query

my search | mcType=delivery Dir=Inbound Sender="*" | eval Deli_yes=if(Delivered="True", 1, 0 ) | eval Deli_no=if(Delivered="False", 1, 0) | stats count AS TotalCount, sum(Deli_yes) AS True, sum(Deli_no) AS False by Sender

I hope this helps.

Thanks,
Harshil

0 Karma

nic28
New Member

think I forgot to give more info. so im looking at all mails coming in from a particular sender. but some mails get delivered and others don't. so the true is delivered and false not. the count just gives the total amount obviously.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...