Splunk Search

How do I only return the first name listed under each Group and how do I count by Groups?

snuggas
New Member

The following query just gives me results but I also need to count by each Group.

index=Container_ship action=Decision result=*
| spath "Groups{}"
| search "Groups{}"=Sedan* OR "Groups{}"=SUV*
| dedup invoice
| timechart span=1mon count by result

 

Results show Yes or No but I also need to count by the Groups which has more than Sedan or SUV listed like color but I also only want to count whatever name appears first in the group entry.

 

Thanks!

Labels (1)
0 Karma

tscroggins
Builder

@snuggas 

To split by more than one field over _time, use bin and stats instead of timechart:

| timechart span=1mon count by result

=>

| bin _time span=1m
| stats count by _time result "Groups{}"

This will generate results with _time, result, Groups{}, and count fields.

0 Karma