- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Grouping multiple times
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Basically I would like to run one stats command where i do some arithmetic and correlation based on one grouping, but i would like to display the results using a different grouping, for example I'm run-in my first stats command grouping by bundle, and display those results grouped by Build.
Thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi raby1996,
The important part is to pass on any needed field for the second stats by adding it to the first stats. Try something like this:
your base search here | stats .... by bundle, Build .... | stats ... by Build
Hope this helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi raby1996,
The important part is to pass on any needed field for the second stats by adding it to the first stats. Try something like this:
your base search here | stats .... by bundle, Build .... | stats ... by Build
Hope this helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hmmmm i might be doing something wrong, here is my first stats
Base Search
| stats values(Group) as Group list("SFI Level") AS LIC2 count list(MTMS) AS MTMS ,list(Build) AS Build list(it2) AS Current_Bundle_Date , list(nowstring) AS Search_Date(Today) , list(TD) AS Difference , sum(TD) AS Sum, by Bundle
| eval MM=Sum/30.4
and my second stats which doesn't give me the right MM
|stats list(Bundle), list(LIC2),list(Build),list(count), by Group
Basically I want to group differently without it affecting my results from the first stats(specifically MM) if that makes sense?
P.S I apologize I actaully want to group by "Group" i just changed the name in my question to make it less confusing .
Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hmm looks like I don't get it; those are two different stats by so the result will not be the same?!?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes you were correct I just had to write and additional stats command with MM included
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If this answers your question, please accept the answer - thanks 🙂
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics!
New in Observability Cloud - Explicit Bucket Histograms
