Splunk Search

Grouping result after stats

SplunkBaby
Explorer

Hi
I have a search like this
host=A |stats last("Status") by TaskId

I like to group the result of above query by Status and then display a pie chart.
I use transaction "Status" but doesn't work out.
Can anybody help me.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

In addition to Rocket66's comment, try this: 'host=A | stats last("Status") as LastStatus by TaskId | chart LastStatus'.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkBaby
Explorer

Thanks it is solved

0 Karma

SplunkBaby
Explorer

I get the result.Result is based on TaskIds.
I want to group that result again based on Status.
for that i use like
host=A |stats last("Status") by TaskId | transaction "Status".
This is not working.How can i achieve this.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

In addition to Rocket66's comment, try this: 'host=A | stats last("Status") as LastStatus by TaskId | chart LastStatus'.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Please accept the answer if it is what got it worked out.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

SplunkBaby
Explorer

This worked out .Thanks man

0 Karma

Rocket66
Communicator

Don't know, what the problem is ...

  • do you get no results (as a list)?
  • you get results but, the pie chart is rendered with wrong or no values?

Maybe your field "Status" is called "status" or "TaskId", "TaskID" or some (other) typo?

Greetz, Robert

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!