So, I am having the following information forwarded to splunk as sourcetype as below (with more than 15000 similar lines):
2021-Jan-14 09:07 2 servername2 instance1 2021-Jan-14 09:07:25.393 [transaction_string1] 79897 67163 OK 1  97 28 OK
I don't have any kind of header of this text file that is forwarded to splunk but I do know how to create one using the Fields options - that won't be an issue.
I need to create a report that has the following specs:
"Scored" - a rangemap for the value which is represented in the text file as 97 (after ) range map should be:
- All: a sum(count) for each range present - if there are no records for a specific range, then 0 should be shown as a total.
- servername (alphabetically sorted) with instanceId (there are 2: 1 and 2 for each servername) - each one getting the count value for each range value in "Scored" mentioned above ---- if there are is 0 as count for a specific range on the servername and instanceid, then 0 should be shown for each servername and instanceid.
Now, by the looks of it, this can be achieved using a pivot. So far, this is what I could've come up with:
The output I need should be similar to one below:
Can anyone help me out on how to build up a search query to actually have the desired output?