Dashboards & Visualizations

Create a Table view of Columns from Source file

Mallik657
Explorer

I have a source file with comma separated fields, I have to create a table where I need combine and show statistics of different products.

Data file fields - TeamName,EmploymentType,Skills,TrainingCompleted

Source File data:
TeamA,Contract,Java,Yes
TeamA,Contract,DotNet,No
TeamA,Contract,C++,Yes
TeamA,Contract,ReactJS,No
TeamB,Permanent,Java,Yes
TeamB,Permanent,DotNet,No
TeamB,Permanent,C++,Yes
TeamB,Permanent,ReactJS,No
TeamC,Contract,Java,Yes
TeamC,Contract,DotNet,No
TeamC,Contract,C++,Yes
TeamC,Contract,ReactJS,No
TeamD,Permanent,Java,Yes
TeamD,Permanent,DotNet,No
TeamD,Permanent,C,Yes
TeamD,Permanent,ReactJS,No
TeamE,Contract,Java,Yes
TeamE,Contract,DotNet,No
TeamE,Contract,Java,Yes

Now the requirement is to create a table view of source file with below columns:

TeamNameEmploymentTypeSkillsTrainingCompletedTeam AppearanceTraining Completion%
TeamAContractJava,DotNet,ReactJS,C++2450%
TeamBPermanentJava,DotNet,ReactJS,C++2450%
TeamCContractJava,DotNet,ReactJS,C++2450%
TeamDPermanentJava,DotNet,ReactJS,C2450%
TeamEContractJava,Dotnet2367%

 

Please give me the exact query. I am beginner in Splunk. 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats values(Skills) as Skills count(eval(TrainingCompleted=="Yes")) as TrainingCompleted count as "Team Appearance" by TeamName EmploymentType
| eval Skills=mvjoin(Skills,",")
| eval "TrainingCompleted%"=round(100*TrainingCompleted/'Team Appearance',0)."%"

View solution in original post

Mallik657
Explorer

Thank you @ITWhisperer   Can you also help me on how I can add another column  "Previous week Training Completion%" 

So that I can compare what is the progress from previous week to present week Training completion.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

That is a different question, given that you don't appear to have any dates in your dataset.

0 Karma

Mallik657
Explorer

@ITWhisperer  Yes that's right. Once in a week the the progress data file will be pushed to Splunk. So how can we compare previous week and this week data for Training completion percentage?

So that i know the progress from the last week to this week.

 

I can post a new question if needed 🙂 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats values(Skills) as Skills count(eval(TrainingCompleted=="Yes")) as TrainingCompleted count as "Team Appearance" by TeamName EmploymentType
| eval Skills=mvjoin(Skills,",")
| eval "TrainingCompleted%"=round(100*TrainingCompleted/'Team Appearance',0)."%"
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...