Splunk Search

How to convert row values into fields with count?

cindywee
New Member

Hi. How do I get from the first table to look like the second table?

I have tried chart, transpose, different combination of eval and stats functions but just cannot get it to look right. I am working off a csv data set.
alt text

0 Karma
1 Solution

solarboyz1
Builder

Add the following to the search you used to generate the first table:

| stats sum(eval(if(status="failure",1,0)) as Failure, sum(eval(if(status="success",1,0)) as Success by Platform, Instance, Group, Container

https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/Usestatswithevalexpressionsandfunctions

View solution in original post

cindywee
New Member

You are a genius. The most simple solution is always to right solution.

0 Karma

solarboyz1
Builder

Add the following to the search you used to generate the first table:

| stats sum(eval(if(status="failure",1,0)) as Failure, sum(eval(if(status="success",1,0)) as Success by Platform, Instance, Group, Container

https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/Usestatswithevalexpressionsandfunctions

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...