Dashboards & Visualizations

How do I group data by a field and write the output counts in a table?

anooshac
Communicator

I have data in json format like this.

 

 

"Task_no":"5",
"Group": "G1",
"EXECUTION_DATE":1648081994535,
"STATUS":"FAILURE",
"DURATION":1951628

 

 

I want to produce a table which has Group Total_tasks SUCCESS FAILURE as fields. I tried the query like this.

 

 

index..... Group=G1| chart count(Task_No) by STATUS
| eval Total_Tasks = SUCCESS + FAILURE
| table Group Total_Tasks  SUCCESS FAILURE

 

 

Its showing as no results found. But when i run the same query for all the group that is,

 

index..... | chart count(Task_No) by Group STATUS
| eval Total_Tasks = SUCCESS + FAILURE
| table Group Total_Tasks  SUCCESS FAILURE

 

this query gives the required fields, but i want the table to be created for particular Group. Can anyone please help me to achieve this?

Labels (3)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index..... Group=G1| chart count(Task_No) by Group STATUS
| fillnull value=0 SUCCESS FAILURE
| eval Total_Tasks = SUCCESS + FAILURE
| table Group Total_Tasks  SUCCESS FAILURE

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try it like this

index..... Group=G1| chart count(Task_No) by Group STATUS
| eval Total_Tasks = SUCCESS + FAILURE
| table Group Total_Tasks  SUCCESS FAILURE

The chart command needs Group even when you have filtered your search

0 Karma

anooshac
Communicator

I  tried like this too.. But in the when "SUCCESS" or "FAILURE" is zero the Total_Tasks column and the respective column which has zero value is shown empty. Zero is not considered and shown as empty. While doing the same for all groups they are coming proper. I want this to be for particular group.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index..... Group=G1| chart count(Task_No) by Group STATUS
| fillnull value=0 SUCCESS FAILURE
| eval Total_Tasks = SUCCESS + FAILURE
| table Group Total_Tasks  SUCCESS FAILURE
0 Karma

anooshac
Communicator

Thank you so much!! Totally forgot about the use of fillnull!

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...