Splunk Search

How can I group the query?


Hi all,

I am new to splunk
Following is the information:

Column1                          Column2         column3
first                            Success
first                            Incomplete
First                           Timeout 

I want the above information like

Column1             successcount               Fail count
first                      1                         2

Note:Here Fail count is Incomplete and Timeout

Can any one help on this how to form a qeury to get the above output


Tags (1)
0 Karma




"your base search " 
| stats count(eval(Column2 ="Success")) as SuccessCount,count(eval(Column2 !="Success")) as FailedCount by Column1

You may change the condition for FailedCount based on your criteria

Happy Splunking!
0 Karma


Hi @uppukumar

Try like

your query..| stats count(eval(Coloumn2="Success")) as "Success count" count(eval(Coloumn2="Incomplete" OR Coloumn2="Timeout")) as "Fail count" by Coloumn1
0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...