Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Splunk Search
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to change the row value to column value ?
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
JyotiP
Path Finder
10-15-2019
11:10 PM
I have the following query
host=*localTest* sourcetype="perf" Path "/api/*/" cache="MISS" OR cache="HIT"
| stats count by Path,cache
And the output of the above query is
|--------------------------------------------------------------------------|
|Path |cache |count |
|--------------------------------------------------------------------------|
|/api/trigger/v1/firmroute |MISS |251 |
|/api/trigger/v1/route/ |MISS |6 |
|/api/testdata/basket/v1/baskets |HIT |3 |
|/api/testdata/basket/v1/baskets |MISS |6 |
|/api/testdata/reference/v1/CounterPartyAccount |MISS |364 |
|/api/testdata/reference/v1/CounterpartyMasterAccount |MISS |364 |
|/api/testdata/v1/graphql |MISS |4350 |
|/api/testdata/v2/graphql |MISS |1117 |
|/api/infrastructure/statuscloud/v1/status |HIT |6 |
|/api/infrastructure/statuscloud/v1/status |MISS |2 |
|/api/ipa/v1/settings/trading |MISS |14 |
|/api/ipa/v1/settings/trading/ |MISS |2 |
|/api/session/v1/Health |MISS |2872 |
|/api/session/v1/alert |MISS |228 |
|/api/session/v1/health |MISS |2484 |
|/api/session/v1/session |HIT |423003 |
|/api/session/v1/session |MISS |516 |
|--------------------------------------------------------------------------|
But I want my output like
--------------------------------------------------------------------------
Path MISS HIT
--------------------------------------------------------------------------
/api/trigger/v1/firmroute 251
/api/trigger/v1/route/ 6
/api/testdata/basket/v1/baskets 6 3
/api/testdata/reference/v1/CounterPartyAccount 364
/api/testdata/reference/v1/CounterpartyMasterAccount 364
/api/testdata/v1/graphql 4350
/api/testdata/v2/graphql 1117
/api/infrastructure/statuscloud/v1/status 2 6
/api/ipa/v1/settings/trading 14
/api/ipa/v1/settings/trading/ 2
/api/session/v1/Health 2872
/api/session/v1/alert 228
/api/session/v1/health 2484
/api/session/v1/session 516 423003
--------------------------------------------------------------------------
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
skrajkumar_splu
Splunk Employee
10-15-2019
11:59 PM
Try using chart instead of stats. like
host=localTest sourcetype="perf" Path "/api/*/" cache="MISS" OR cache="HIT" | chart count over cache by Path
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
skrajkumar_splu
Splunk Employee
10-15-2019
11:59 PM
Try using chart instead of stats. like
host=localTest sourcetype="perf" Path "/api/*/" cache="MISS" OR cache="HIT" | chart count over cache by Path
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
JyotiP
Path Finder
10-16-2019
12:15 AM
@skrajkumar_splunk thanks for sharing the query, I have just modified the positions and it fulfills my requirement,
host=localTest sourcetype="perf" Path "/api/*/" cache="MISS" OR cache="HIT" | chart count over Path by cache
Or
host=localTest sourcetype="perf" Path "/api/*/" cache="MISS" OR cache="HIT" | stats count(eval(cache="MISS")) AS MISS count(eval(cache="HIT")) AS HIT by Path
Get Updates on the Splunk Community!
Enterprise Security Content Update (ESCU) | New Releases
In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
(This is the first of a series of 2 blogs).
Splunk Enterprise Security is a fantastic tool that offers robust ...
Index This | What are the 12 Days of Splunk-mas?
December 2024 Edition
Hayyy Splunk Education Enthusiasts and the Eternally Curious!
We’re back with another ...
