Splunk Search

How can I show the total count as well as completed count?

akshaypillai
Engager

If I have to show that 8 out of 10 tickets have been closed how can I best show this? I need to show the total count as well as completed count

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should get you started. You'll likely need to change the eval expression to whatever indicates a closed ticket.

<your base search for all tickets> | stats count(eval(status=Closed)) as closed, count as total | eval "Percentage Closed"=(closed*100)/total | rename closed as "Tickets Closed", total as "Total Tickets" | table "Tickets Closed" "Total Tickets" "Percentage Closed"
---
If this reply helps you, Karma would be appreciated.
0 Karma

elliotproebstel
Champion

One way to visually represent this would be to create a statistics table like this (with the percentage column optional, but nice to have):

Tickets Closed | Total Tickets | Percentage Closed
8              | 10            | 80%

Alternately, you could make a dashboard with two single items (or three, if you wanted the percentage), one for each value. And another way that would make sense to present that data would be a pie chart.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...