Dashboards & Visualizations

Create a Table view of Columns from Source file

Mallik657
Explorer

I have a source file with comma separated fields, I have to create a table where I need combine and show statistics of different products.

Data file fields - TeamName,EmploymentType,Skills,TrainingCompleted

Source File data:
TeamA,Contract,Java,Yes
TeamA,Contract,DotNet,No
TeamA,Contract,C++,Yes
TeamA,Contract,ReactJS,No
TeamB,Permanent,Java,Yes
TeamB,Permanent,DotNet,No
TeamB,Permanent,C++,Yes
TeamB,Permanent,ReactJS,No
TeamC,Contract,Java,Yes
TeamC,Contract,DotNet,No
TeamC,Contract,C++,Yes
TeamC,Contract,ReactJS,No
TeamD,Permanent,Java,Yes
TeamD,Permanent,DotNet,No
TeamD,Permanent,C,Yes
TeamD,Permanent,ReactJS,No
TeamE,Contract,Java,Yes
TeamE,Contract,DotNet,No
TeamE,Contract,Java,Yes

Now the requirement is to create a table view of source file with below columns:

TeamNameEmploymentTypeSkillsTrainingCompletedTeam AppearanceTraining Completion%
TeamAContractJava,DotNet,ReactJS,C++2450%
TeamBPermanentJava,DotNet,ReactJS,C++2450%
TeamCContractJava,DotNet,ReactJS,C++2450%
TeamDPermanentJava,DotNet,ReactJS,C2450%
TeamEContractJava,Dotnet2367%

 

Please give me the exact query. I am beginner in Splunk. 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats values(Skills) as Skills count(eval(TrainingCompleted=="Yes")) as TrainingCompleted count as "Team Appearance" by TeamName EmploymentType
| eval Skills=mvjoin(Skills,",")
| eval "TrainingCompleted%"=round(100*TrainingCompleted/'Team Appearance',0)."%"

View solution in original post

Mallik657
Explorer

Thank you @ITWhisperer   Can you also help me on how I can add another column  "Previous week Training Completion%" 

So that I can compare what is the progress from previous week to present week Training completion.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

That is a different question, given that you don't appear to have any dates in your dataset.

0 Karma

Mallik657
Explorer

@ITWhisperer  Yes that's right. Once in a week the the progress data file will be pushed to Splunk. So how can we compare previous week and this week data for Training completion percentage?

So that i know the progress from the last week to this week.

 

I can post a new question if needed 🙂 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats values(Skills) as Skills count(eval(TrainingCompleted=="Yes")) as TrainingCompleted count as "Team Appearance" by TeamName EmploymentType
| eval Skills=mvjoin(Skills,",")
| eval "TrainingCompleted%"=round(100*TrainingCompleted/'Team Appearance',0)."%"
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...