Splunk Search

How to group values

becksyboy
Contributor

Hi

I have a field name called report_name, it can have a number of status values associated with it, i.e. status=a or status=b or status=c etc.

A complete report run would have (status = a & status = b)
A failed report run would have (status = a & status = b & status = c)
How do I group results where (status = a & status = b) = Good  and (status = a & status = b & status = c) = Failed for a particular report name?
The issue I'm running into is when a report_name has both (status = a & status = b) &  a little while later (status = a & status = b & status = c) I am unable to group them correctly, and end up naming both the same. 
 
thanks
Labels (1)
0 Karma

somesoni2
Revered Legend

What is the frequency of the report? For your report's timerange, does the the report run once OR multiple times? Is there any other field using which  you can uniquely identify a report's execution? If you have a key field OR set of key fields, you'd be able to use `| stats list(status) as statuses ... by key_fields` to get list of status return and then categorize them by that.

0 Karma

becksyboy
Contributor

Thanks for the suggestions, I will investigate to see if there is a unique field.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...