I have data in json format like this.
"Task_no":"5",
"Group": "G1",
"EXECUTION_DATE":1648081994535,
"STATUS":"FAILURE",
"DURATION":1951628
I want to produce a table which has Group Total_tasks SUCCESS FAILURE as fields. I tried the query like this.
index..... Group=G1| chart count(Task_No) by STATUS
| eval Total_Tasks = SUCCESS + FAILURE
| table Group Total_Tasks SUCCESS FAILURE
Its showing as no results found. But when i run the same query for all the group that is,
index..... | chart count(Task_No) by Group STATUS
| eval Total_Tasks = SUCCESS + FAILURE
| table Group Total_Tasks SUCCESS FAILURE
this query gives the required fields, but i want the table to be created for particular Group. Can anyone please help me to achieve this?
Try something like this
index..... Group=G1| chart count(Task_No) by Group STATUS
| fillnull value=0 SUCCESS FAILURE
| eval Total_Tasks = SUCCESS + FAILURE
| table Group Total_Tasks SUCCESS FAILURE
Try it like this
index..... Group=G1| chart count(Task_No) by Group STATUS
| eval Total_Tasks = SUCCESS + FAILURE
| table Group Total_Tasks SUCCESS FAILURE
The chart command needs Group even when you have filtered your search
I tried like this too.. But in the when "SUCCESS" or "FAILURE" is zero the Total_Tasks column and the respective column which has zero value is shown empty. Zero is not considered and shown as empty. While doing the same for all groups they are coming proper. I want this to be for particular group.
Try something like this
index..... Group=G1| chart count(Task_No) by Group STATUS
| fillnull value=0 SUCCESS FAILURE
| eval Total_Tasks = SUCCESS + FAILURE
| table Group Total_Tasks SUCCESS FAILURE
Thank you so much!! Totally forgot about the use of fillnull!