Query format for viewing server name with count on respect of color

[sushil_sh]

Hi Team,

I am very new in Splunk and i need your help to change my query as per requirement  

Please validate my syantax  as per requirement How do we get list of server name with count(which is change color like grey or Uninitialized) instead of count of server (server name comes under ServerName)

Please find my syntax and result

sourcetype=ABC Category IN ("Support","Patch") HealthValue IN(Grey, Uninitialized,) | bin _time span=1d | dedup ServerName HealthValue _time | timechart count(ServerName) as "QTY Servers" by HealthValue

i am waiting for quick response

[ITWhisperer]

sourcetype=ABC Category IN ("Support","Patch") HealthValue IN(Grey, Uninitialized,) | bin _time span=1d | dedup ServerName HealthValue _time | stats values(ServerName) as "Servers" by HealthValue _time

[sushil_sh]

Thanks for your response

@ITWhisperer  how do we get clour cout on the refference of server name

Eg:- suppose  one server change color 3 time in time _time then how do i express  this query in syntax

like below

Server	Colour	Count	Time
xyz	Grey	3	1:00

Thanks in advance

[ITWhisperer · Accepted solution]

sourcetype=ABC Category IN ("Support","Patch") HealthValue IN(Grey, Uninitialized,) | bin _time span=1d | stats count by ServerName HealthValue _time