Splunk Search

How to get the count based on sub_group?

ramkyreddy
Explorer

    platfrom      bkc_name     domain   testcase_id
   tnl                 abzke             hef                  gh_102

   asc                   kit1            touch                ig_103

  sou                   kit2            hub                     jk_104

  img                   kit3             hub1                 lk_105

-------------------------------

sub_gruop    platfrom      bkc_name     domain   testcase_id

wow                   20                        19                  15                    12

audio                10                         16                   11                    13

sound                25                        30                  18                    19

 

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Can you explain your example. What is the first section - there are no values there, so what count do you want. What do the numbers in the second section mean? e.g. what is wow/platform value of 20?

 

0 Karma

ramkyreddy
Explorer

In the input table i have 4 subgroups, keep subgroup as its same as in output,
but i need count for platform, akc_name, station ,domain, testcase_id as i mentioned in output

INPUT
-----

ineed count like this

0 Karma

bowesmana
SplunkTrust
SplunkTrust

I'm afraid you'll have to be a bit clearer. Although you say "keep subgroup same as in output", you input and output show different values for sub groups, none of the sub_group names in the INPUT appear in the OUTPUT

INPUT

CVB-Driver
RFT-Driver
Touch-rpl
PSC-Firmwar

OUTPUT

HEF-Driver
VPU-Driver
iTouch rpl
CPS-Firmware

Also your image shows a subgroup of WOV with Total, Planned and Automated - how are these values calculated and from what data and how do those numbers relate to the columns in your output 

platform       akc_name             station                       domain    Testcase_id

It's likely that a simple "stats count ... by sub_groups" will be the answer, but there is just not enough information to provide a clear answer.

 

0 Karma

ramkyreddy
Explorer

let me explain i have this table i need count for platfrom, stationnam by subgroup  this is my input.

--------

 

output
-----------

like this i need output i think you got clear understand right.

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Sorry, it's still unclear - please can you say what the 3 values in each of the columns is counting. 

For example, you have 369 against WOV - what does that 369 represent in each of the 3 columns? The platform value in your example is 'adl'. How do you want to count 'platform'  

What about the  TCSS row - what have you counted to get 136, 100 and 60 values in there?

In your example data you have two rows. If you "count" those rows, would you end up with 

TCSS 2 2

which is showing 2 _different_ values of platform and 2 _different_ values of station_name

 

 

0 Karma

ramkyreddy
Explorer

Thanks, i made it using stats count by sub group (using sub search) its working.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...