Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- How to transpose 2nd column
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have query as shown below,
|stats count by stn stn_status
result:
stn stn_state count
stn_1 completed 20
stn_1 In progress 2
stn_1 failed 8
stn_2 completed 30
stn_3 completed 10
stn_3 failed 10
expected results:
Stn completed In progress failed
stn_1 20 2 8
stn_2 30
stn_3 10 10
Help me on this, Thanks in Advance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Replace your stats command with this:
| chart count over stn by stn_state
Note: I couldn't tell whether the correct field name is "stn_state" or "stn_status" since you use both in your question. Use the correct field name in this chart command, and you should get the results you want.
Hope that helps!
rmmiller
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Simply change stats to chart; no other changes are necessary.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Replace your stats command with this:
| chart count over stn by stn_state
Note: I couldn't tell whether the correct field name is "stn_state" or "stn_status" since you use both in your question. Use the correct field name in this chart command, and you should get the results you want.
Hope that helps!
rmmiller
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It Works, Thank you very much.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Index This | What travels the world but is also stuck in place?
Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data
Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...
