Reporting

How to group by multiple fields?

Leo_Pegasus
New Member
 

I have following splunk fields

Date,Group,State 

State can have following values InProgress|Declined|Submitted

I like to get following result

Date.          Group. TotalInProgress.  TotalDeclined TotalSubmitted. Total
-----------------------------------------------------------------------------     
12-12-2021       A.     13.              10               15           38

I couldn't figured it out. Any help would be appreciated

Labels (1)
Tags (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You need to concatenate the fields, do the stats (well chart to be precise), then split the concatenated field

| makeresults count=100
| eval date=strftime(relative_time(now(),"-".(random()%10)."d@d"),"%F")
| eval group=mvindex(split("ABC",""),random()%3)
| eval state=mvindex(split("InProgress|Declined|Submitted","|"),random()%3)



| eval dategroup=date."|".group
| chart count by dategroup state
| addtotals
| eval date=mvindex(split(dategroup,"|"),0)
| eval group=mvindex(split(dategroup,"|"),1)
| fields - dategroup
| table date group * Total
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Edited: Bad first response. You can do this with two stats 

 

your_search
| stats count by Date Group State
| eval "Total{State}"=count
| fields - State count
| stats values(*) as * by Date Group
| addtotals

 

 

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...