Splunk Search

How to convert row values into fields with count?

cindywee
New Member

Hi. How do I get from the first table to look like the second table?

I have tried chart, transpose, different combination of eval and stats functions but just cannot get it to look right. I am working off a csv data set.
alt text

0 Karma
1 Solution

solarboyz1
Builder

Add the following to the search you used to generate the first table:

| stats sum(eval(if(status="failure",1,0)) as Failure, sum(eval(if(status="success",1,0)) as Success by Platform, Instance, Group, Container

https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/Usestatswithevalexpressionsandfunctions

View solution in original post

cindywee
New Member

You are a genius. The most simple solution is always to right solution.

0 Karma

solarboyz1
Builder

Add the following to the search you used to generate the first table:

| stats sum(eval(if(status="failure",1,0)) as Failure, sum(eval(if(status="success",1,0)) as Success by Platform, Instance, Group, Container

https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/Usestatswithevalexpressionsandfunctions

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...