Group events into a single event

[schou87]

I am relatively new to this wonderful tool called SPLUNK. Please excuse me if this question has already been answered.

I have event logs from an SFTP . Below is the table from logs

Current_Status          Count

Delivered                       56415

Pending                          10000

Failed                               200

Error                                 300

My requirement is below :

Current_Status          Count

Delivered                       56415

Pending                          10000

Others                             500

Please help..

Thank you in advance.

[ITWhisperer]

How did you generate the first table as it might be easier to go back a step?

[schou87]

base search | stats count by current_Status

[ITWhisperer · Accepted solution]

base search 
| eval current_Status=if(current_Status!="Delivered" AND current_Status!="Pending","Other",current_Status)
| stats count by current_Status

[schou87]

Thank you !! This worked perfect 😀