Splunk Search

How do I edit my search to group FieldB values by FieldA?

pradiptam
Explorer

My input table is like this

Ticket No   Tower    Status
1           Backup  Resolved
2           Storage   WIP
3           Vmware  Resolved
4           Backup  Pending with Customer
5           Vmware  WIP

My Output table should be like this

Ticket Count    Tower     Status
   2            Backup    Resolved,   Pending with Customer
   2            Vmware    WIP, Resolved
   1            Storage   WIP

I am not getting the desired results as expected while visualizing the same. I am using the following search:

| inputlookup report_data.csv | search  "Create month"=Nov | stats count(Ticket no.)  as "Tickets Received" by Tower , Status

Any help in this regards will be appreciated.

Regards,

Pradipta

0 Karma
1 Solution

renjith_nair
Legend

Try this for exact output.

| inputlookup report_data.csv | search  "Create month"=Nov |stats delim="," count(Ticket no.)  as "Tickets Received",values(Status) as Status by Tower|mvcombine Status|sort - "Tickets Received"
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

Try this for exact output.

| inputlookup report_data.csv | search  "Create month"=Nov |stats delim="," count(Ticket no.)  as "Tickets Received",values(Status) as Status by Tower|mvcombine Status|sort - "Tickets Received"
---
What goes around comes around. If it helps, hit it with Karma 🙂

pradiptam
Explorer

Thanks to both richgalloway and renjith.nair. I am getting the output as desired by running ' renjith's ' query. When i go to visualization tab it shows me ' tickets reiceived => 2 ' for Backup. Can here modifications be done to show " Resolved, Pending with Customer ".

Can this be done , any suggestions i can try out.

Pradipta

0 Karma

renjith_nair
Legend

Hello Pradipta, Please mark the answer as an accepted answer if you are happy with that.
Regarding the change in field name, as you might know, you can only plot against an aggregated function or time , you can't plot two strings against each other.

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

javiergn
Super Champion

I would do the following:

| inputlookup report_data.csv 
| search "Create month"=Nov 
| stats count(Status) as "Tickets Received", list(Status) as Status by Tower
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this.

| inputlookup report_data.csv | search "Create month"=Nov | stats count(Ticket no.) as "Tickets Count" by Tower , Status | sort - "Ticket Count" | table "Ticket Count" Tower Status
---
If this reply helps you, Karma would be appreciated.
0 Karma

pradiptam
Explorer

Hi All,

Thanks all for your support , i have resolved my issue. Done the Following steps:

1) Uploaded the File as csv.
2) Created a Data Model, based on the same.
3) Created a pivot and got my desired output. Not using inputlookup, using SPL.

Regards,
Pradipta

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...