Splunk Search

Finding difficulty in getting the result as count

srinivas_gowda
Path Finder

Hello all,

 

I am facing an issue below while trying to get the result to add in the dashboard. 

Here I am trying to get the count for the servers based on their Overall_Status.


| My search | 

|search Overall_Status="Success" OR Overall_Status="Failed" OR Overall_Status="Skipped" OR Overall_Status="NA"


I will now need to get the result as below.

 

Success       Failed        Skipped        NA
        8                   4                    2                 2

 

This could then be added to the dashboard. Can you please guide me through this.

Labels (5)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@srinivas_gowda 

Try this

YOUR_SEARCH
|stats count by Overall_Status | transpose 0 header_field="Overall_Status" | fields - column | rename Success as "Successfull", NA as "Failed to complete(NA)", Failed as "Unsuccessfull(Failed)" | table Successfull "Unsuccessfull(Failed)" Skipped "Failed to complete(NA)"

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@srinivas_gowda 

Try by adding this.

|stats count by Overall_Status | transpose 0 header_field="Overall_Status" | fields - column

 

KV 

0 Karma

srinivas_gowda
Path Finder

Hello, this worked. Thank you. Can you please also let me know how the values could be renamed here? for eg Success as "Successfull", NA as "Failed to complete"

 

Also, when I try the query given by you is there a way to place the result as needed. Below is the result from the query.

Failed NA Skipped Success

41218

 

 

Can I rearrange the given result as below:

Successfull    Unsuccessfull(Failed)    Skipped     Failed to complete(NA)

           8                                      4                             1                                    12

 

Thank you

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@srinivas_gowda 

Try this

YOUR_SEARCH
|stats count by Overall_Status | transpose 0 header_field="Overall_Status" | fields - column | rename Success as "Successfull", NA as "Failed to complete(NA)", Failed as "Unsuccessfull(Failed)" | table Successfull "Unsuccessfull(Failed)" Skipped "Failed to complete(NA)"

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...