Splunk Search

Grouping result after stats

Explorer

Hi
I have a search like this
host=A |stats last("Status") by TaskId

I like to group the result of above query by Status and then display a pie chart.
I use transaction "Status" but doesn't work out.
Can anybody help me.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

In addition to Rocket66's comment, try this: 'host=A | stats last("Status") as LastStatus by TaskId | chart LastStatus'.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Explorer

Thanks it is solved

0 Karma

Explorer

I get the result.Result is based on TaskIds.
I want to group that result again based on Status.
for that i use like
host=A |stats last("Status") by TaskId | transaction "Status".
This is not working.How can i achieve this.

0 Karma

SplunkTrust
SplunkTrust

In addition to Rocket66's comment, try this: 'host=A | stats last("Status") as LastStatus by TaskId | chart LastStatus'.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

Please accept the answer if it is what got it worked out.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

This worked out .Thanks man

0 Karma

Communicator

Don't know, what the problem is ...

  • do you get no results (as a list)?
  • you get results but, the pie chart is rendered with wrong or no values?

Maybe your field "Status" is called "status" or "TaskId", "TaskID" or some (other) typo?

Greetz, Robert

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!