Extracting the data from Table

[varunapj]

Hi All,
I am new to SPLUNK and building dashboards and I have requirement to count the records from the table

1. No of Approved records index="XXXXX" PRODUCT=100| dedup PCN |stats count(eval(STATUS="A")) AS APPROVED
2. No of Cancelled records index="XXXXX" PRODUCT=100| dedup PCN |stats count(eval(STATUS="C")) AS APPROVED
3. No of Pending records index="XXXXX" PRODUCT=100 | stats latest(STATUS) as STATUS | where STATUS="P" --> This is not returning any results.

So, any thoughts on it ?

Thanks in advance.

[mayurr98]

If you want to find a number of pending records then you should write

index="XXXXX" PRODUCT=100 STATUS="P" | stats dc(PCN) as "Pending"

Also if you want all the three requirements in one dashboard then you can try something like this

 index="XXXXX" PRODUCT=100 | stats dc(PCN) by STATUS

let me know if this helps!