Getting Data In

How to get count of success and failure?

Jasmine
Path Finder

i have json input 

Please find the Query  below:

...

...

| stats values(*) as * by Id| eval Status=if(match(Error,"^[a-zA-Z0-9_]"),"Failure","Success")| stats Count by Dept,Status

i can print as below in dashboard

Dept Status Count
Accounts Success 4
Accounts Failure 7
Mechanical Success 4
Mechanical Failure 4

 

i want to print as below:

 

Dept Success  Failure total
Accounts 5 1 6
Mechanical 6 2 8

 

Please help here

Labels (1)
0 Karma

GaetanVP
Contributor

Hello @Jasmine,

Could you please share the JSON you have in inputs please ? Would be helpful to do some tests and give you an answer !

Thanks
GaetanVP

0 Karma

Jasmine
Path Finder
2023-07-13 07:53:15,155 - __main__ - INFO - "{\"Id\": \"123456JKL\", \"Dept\": \"Accounts\", \"Time1\": \"3.04\"}"
2023-07-13 07:53:15,155 - __main__ - INFO - "{\"Id\": \"123456JKL\", \"Dept\": \"Mechanical\", \"Time2\": \"4.05\"}"
2023-07-13 07:53:15,155 - __main__ - INFO - "{\"Id\": \"123456JKL\", \"Dept\": \"Mechanical\",\"Error\": \"ErrorFound\"}"

Here i am  extracting each field and showing in table. if error found, adding Status as Success and Failure as below

| stats values(*) as * by UniqueId| eval Status=if(match(Error,"^[a-zA-Z0-9_]"),"Failure","Success")| stats Count by PhaseName,Status

with the above code 

DeptStatusCount
AccountsSuccess4
AccountsFailure7
MechanicalSuccess4
MechanicalFailure4

 

But i want like this:

DeptSuccess Failuretotal
Accounts516
Mechanical628
0 Karma

Thulasinathan_M
Contributor

Hi,

If your trying to match word 'Error' and it's followed by your Dept then below query would do the trick.

| rex field=Logs "Dept\W+(?<Dept>\w+)\W+(?<Status>\w+)"
| eval Status=if(match("Error", Status),"Failure","Success") 
| stats count(eval(Status="Success")) as Success, count(eval(Status="Failure")) as Failure by Dept
| eval Total = coalesce(Success, 0) + coalesce(Failure, 0)
| table Dept, Success, Failure, Total

 

Jasmine
Path Finder

i am getting as below:

DeptSuccess Failuretotal
Accounts505
Accounts011
Mechanical066
Mechanical202

 

i want as 

DeptSuccess Failuretotal
Accounts516
Mechanical628
0 Karma

Jasmine
Path Finder

Please ignore the above query. It works perfect

0 Karma

Thulasinathan_M
Contributor

If the query worked, you can mark it as a solution. It'll will help someone who refers similar thing in future. Cheers!!

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...