Hello Splunkers!!
I need the results as per the below format. I have tried some SPL but not achieved with the expected results. Please help me to achieve the same.
| |
Order Status |
AU |
NZ |
UK |
| 02:00:00 |
created. |
10 |
11 |
12 |
| |
released |
9 |
8 |
6 |
| |
shipped |
6 |
7 |
4 |
| |
|
|
|
|
| |
|
AU |
NZ |
UK |
| 03:00:00 |
created. |
10 |
11 |
12 |
| |
released |
9 |
8 |
6 |
| |
shipped |
6 |
7 |
4 |
What I have done so far In SPL :
index="ABC "OrderStatus=created" OR "OrderStatus=Shipped" OR "OrderStatus=Released" OR "OrderStatus=Cancelled"
| rex field=_raw "SellerOrganizationCode\=one\_(?<Market>[A-Z]{2})"
| search NOT (Market="CA" OR Market="US" OR Market="KO" OR Market="SE" OR Market="NL" OR Market="IE" OR Market="NO" OR Market="LA")
| replace CH WITH EU GB WITH UK
| bin _time span=1h
| eval Time=strftime(_time,"%m/%d-%y %H:%M:%S.%Q %p")
| eval newtime=strptime(Time,"%m/%d-%y %H:%M:%S.%Q %p")
| eval Time_Hour=strftime(newtime,"%m/%d/%Y %H:%M")
| chart count by Time_Hour,Market usenull=f
| addtotals col=true row=true label=Total labelfield=Time_Hour
| rename Total as "Total orders for the hour"
