Splunk Cloud Platform

How to display data?

nicksrulz
Explorer

Hi Experts,


Need help in displaying data , Currently i am able to display search data as

Status Date                   Date & Time              REASON_CODE
FAILED 25/04/2023 25/04/2023 20:33 Z910
FAILED 25/04/2023 25/04/2023 20:11 Z910
FAILED 25/04/2023 25/04/2023 3:38 Z911
FAILED 25/04/2023 25/04/2023 3:37 Z911
FAILED 25/04/2023 25/04/2023 3:37 Z911
FAILED 25/04/2023 25/04/2023 3:36 Z911

using below query :
============================================
index=test sourcetype="*" STATUS_REASON_CODE IN (U220, U902, U904, U905, Z704, Z900, Z902, Z903, Z904, Z910, Z911, Z912, Z913, Z914, Z920, Z922, Z923, Z924) STATE = FAILED | fields STATE _time STATUS_REASON_CODE | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) AS Time | convert timeformat="%Y-%m-%d" ctime(_time) AS TimeDay | eval FailTime=case(field_name="Failure Time", _time) | eval ReasonCode=case(field_name="Reason Code", STATUS_REASON_CODE) | eval State=case(field_name="State", STATE) | eval minTime = (min(Time)) | rename STATUS_REASON_CODE as REASON_CODE | sort - Time | table STATE TimeDay minTime REASON_CODE
==================================================

Need help in displaying data as :


Status    Date                     Start Time                  End Time                    REASON_CODE Count
FAILED   25/04/2023   25/04/2023 20:11 25/04/2023 20:33    Z910                  2
FAILED   25/04/2023   25/04/2023 3:36    25/04/2023 3:38      Z911                   4

Please help in modifying my query.

Labels (1)
Tags (1)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Instead of the | table command you might find something like this gives you what you need:

| stats count as ReasonCount, min(_time) as startTime, max(_time) AS endTime by REASON_CODE
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...