Splunk Search

How to convert row values into fields with count?

cindywee
New Member

Hi. How do I get from the first table to look like the second table?

I have tried chart, transpose, different combination of eval and stats functions but just cannot get it to look right. I am working off a csv data set.
alt text

0 Karma
1 Solution

solarboyz1
Builder

Add the following to the search you used to generate the first table:

| stats sum(eval(if(status="failure",1,0)) as Failure, sum(eval(if(status="success",1,0)) as Success by Platform, Instance, Group, Container

https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/Usestatswithevalexpressionsandfunctions

View solution in original post

cindywee
New Member

You are a genius. The most simple solution is always to right solution.

0 Karma

solarboyz1
Builder

Add the following to the search you used to generate the first table:

| stats sum(eval(if(status="failure",1,0)) as Failure, sum(eval(if(status="success",1,0)) as Success by Platform, Instance, Group, Container

https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/Usestatswithevalexpressionsandfunctions

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!