Reporting

Printing distinct Value of age

gajananh999
Contributor

Dear All,

Search=index="inforce_analytix"|eval Age=2013-Subscriber_Birth_Year |bin Age span=5 | eval Total Covered Amount=(coverage_Amount1+coverage_Amount1)| stats sum(Total Covered Amount),sum(NumberOfCoveredPersons),sum(Policy_Premium) by Age,Product_Name

result =

20-25 children plan 24 35 46

20-25 furure plan 23 34 34

20-25 retirement plan 45 45 76


26-30 children plan 24 35 46

25-30 furure plan 23 34 34

25-30 retirement plan 45 45 76

there age is repeating. I want to show age as one time only.for the first line only

Thanks
Gajanan Hiroji

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

You can do it like so;

index="inforce_analytix" 
| eval Age=2013-Subscriber_Birth_Year 
| bin Age span=5 
| eval Total_Covered_Amount=(coverage_Amount1+coverage_Amount1)
| stats sum(Total_Covered_Amount) as CA ,sum(NumberOfCoveredPersons) as CP ,sum(Policy_Premium) as PP by Age,Product_Name 
| eval theStuff= Product_Name . " " . CA . " " . CP . " " . PP
| stats list(theStuff) by Age

From this point on, all but the Age is just a concatenated string, so further processing will be hard.

/k

Ayn
Legend

I don't know of a way to format the output like that, sorry.

0 Karma

gajananh999
Contributor

see my output should be like this

20-25 children plan 24 35 46
furure plan 23 34 34
retirement plan 45 45 76

26-30 children plan 24 35 46
furure plan 23 34 34
retirement plan 45 45 76

0 Karma

Ayn
Legend

Well you can't have it both ways - either you split by product_name and age, and that will, well, result in that you get stats split by product_name and age, or you split in some other way. I'm not sure what your desired output is.

0 Karma

gajananh999
Contributor

I want to split by product Name but i want to print that age only at once.

0 Karma

Ayn
Legend

...so you don't want to split it by Product_Name?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...