Splunk Search

Equivalent of using an eval inside a stats sum(count)?

Lucas_K
Motivator

I have the following search used to gather data which is used later in a hiddenpostprocess search :

index=blah | stats count by Product_Group, Application, Severity, _time

My postprocessing seach is :

stats sum(count) AS Count by Product_Group Severity 

Which outputs the data in a multiline per product format.
ie.

Product_Group Severity Count
A   Major   1
B   Major   1
C   Major   6
C   Minor   1
D   Minor   2
E   Minor   1
F   Critical 92
F   Major   117

3 columns. Product_group Severity and count.

I would like to format the data like this.

Product_Group Critical Major Minor
A 0 1 0
B 0 1 0
C 0 6 1
D 0 0 2
E 0 0 1
F 92 117 0

Prior to using postprocessing a search that would provides the format I want would be :

stats sum(eval(Severity="Critical")) AS Critical, sum(eval(Severity="Major")) AS Major, sum(eval(Severity="Minor")) AS Minor by Product_Group | sort - num(Critical)

Is it possible to use an eval within a stats sum(count)?
Anytime I try to do an eval inside that I get zero values.

edit #1: Tried using a chart command

| stats sum(count) AS Count by Product_Group Severity | chart Count over Product_Group by Severity

But it is not fed the correct data so its wrong (but right visual format however!).

Tags (4)
1 Solution

Lucas_K
Motivator

i was close with my first edit.

The solution for those playing at home.

chart sum(count) AS Count over Product_Group by Severity

So simple facepalm.

View solution in original post

Lucas_K
Motivator

i was close with my first edit.

The solution for those playing at home.

chart sum(count) AS Count over Product_Group by Severity

So simple facepalm.

Get Updates on the Splunk Community!

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...