How do I group data by a field and write the output counts in a table?

[anooshac]

I have data in json format like this.

"Task_no":"5",
"Group": "G1",
"EXECUTION_DATE":1648081994535,
"STATUS":"FAILURE",
"DURATION":1951628

I want to produce a table which has Group Total_tasks SUCCESS FAILURE as fields. I tried the query like this.

index..... Group=G1| chart count(Task_No) by STATUS
| eval Total_Tasks = SUCCESS + FAILURE
| table Group Total_Tasks  SUCCESS FAILURE

Its showing as no results found. But when i run the same query for all the group that is,

index..... | chart count(Task_No) by Group STATUS
| eval Total_Tasks = SUCCESS + FAILURE
| table Group Total_Tasks  SUCCESS FAILURE

this query gives the required fields, but i want the table to be created for particular Group. Can anyone please help me to achieve this?

[ITWhisperer]

Try it like this

index..... Group=G1| chart count(Task_No) by Group STATUS
| eval Total_Tasks = SUCCESS + FAILURE
| table Group Total_Tasks  SUCCESS FAILURE

The chart command needs Group even when you have filtered your search

[anooshac]

I  tried like this too.. But in the when "SUCCESS" or "FAILURE" is zero the Total_Tasks column and the respective column which has zero value is shown empty. Zero is not considered and shown as empty. While doing the same for all groups they are coming proper. I want this to be for particular group.

[ITWhisperer · Accepted solution]

Try something like this

index..... Group=G1| chart count(Task_No) by Group STATUS
| fillnull value=0 SUCCESS FAILURE
| eval Total_Tasks = SUCCESS + FAILURE
| table Group Total_Tasks  SUCCESS FAILURE

[anooshac]

Thank you so much!! Totally forgot about the use of fillnull!