Splunk Search

Grouping result after stats

SplunkBaby
Explorer

Hi
I have a search like this
host=A |stats last("Status") by TaskId

I like to group the result of above query by Status and then display a pie chart.
I use transaction "Status" but doesn't work out.
Can anybody help me.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

In addition to Rocket66's comment, try this: 'host=A | stats last("Status") as LastStatus by TaskId | chart LastStatus'.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

SplunkBaby
Explorer

Thanks it is solved

0 Karma

SplunkBaby
Explorer

I get the result.Result is based on TaskIds.
I want to group that result again based on Status.
for that i use like
host=A |stats last("Status") by TaskId | transaction "Status".
This is not working.How can i achieve this.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

In addition to Rocket66's comment, try this: 'host=A | stats last("Status") as LastStatus by TaskId | chart LastStatus'.

---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

Please accept the answer if it is what got it worked out.

---
If this reply helps you, Karma would be appreciated.
0 Karma

SplunkBaby
Explorer

This worked out .Thanks man

0 Karma

Rocket66
Communicator

Don't know, what the problem is ...

  • do you get no results (as a list)?
  • you get results but, the pie chart is rendered with wrong or no values?

Maybe your field "Status" is called "status" or "TaskId", "TaskID" or some (other) typo?

Greetz, Robert

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...