Reporting

Multiple queries on pivot report

jugarugabi
Path Finder

Hello, 

I have the following search string: 

 

index = app_events_dbdetect_actimize_event_us_uat sourcetype = txndata | rangemap field=Time_taken_AIS_tomcat 0s-to-0.05s=0-50 0.05s-to-0.10s=51-100 0.10s-to-0.15s=101-150 0.15s-to-0.20s=151-200 0.20s-to-0.30s=201-300 0.30s-to-0.50s=301-500 0.50s-to-1s=501-1000 1s-to-2s=1001-2000 2s-to-3s=2001-3000 3s-to-5s=3001-5000 5s-to-30s=5001-30000 >30s=30001-99999

 

 Which is passed to a pivot table as a dataset. 

The output is like this:

pivot.JPG

Now, there are some things that I want to know: 

a) how can I sort the Column Values to be fraasdetppu1, fraasdetppu2, fraasdetppu10, fraasdetppu20...? It currently displays the information as fraasdetppu1, fraasdetppu10, fraasdetppu2, fraasdetppu21...

b) If the output has 0 values for 0s to 0.05s (for example), can I have it displayed here? I cannot seem to find where to get them displayed even if the "scored" items are 0 for the other ranges.

c) The grey line that has the totals shown for each server: can I add custom text under "scored" column?

d) Can a "Total" column be added right before the server names? It needs to sum up the count values of each server, for that specific "scoring" speed. 

Thank you!

Labels (1)
0 Karma

jugarugabi
Path Finder

Tried with the search query: 

index = app_events_dbdetect_actimize_event_us_uat sourcetype = txndata | rangemap field=Time_taken_AIS_tomcat 0s-to-0.05s=0-50 0.05s-to-0.10s=51-100 0.10s-to-0.15s=101-150 0.15s-to-0.20s=151-200 0.20s-to-0.30s=201-300 0.30s-to-0.50s=301-500 0.50s-to-1s=501-1000 1s-to-2s=1001-2000 2s-to-3s=2001-3000 3s-to-5s=3001-5000 5s-to-30s=5001-30000 >30s=30001-99999 | fillnull range value=NULL

but this didn't helped either. 

0 Karma
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...