Splunk Search

How to transform above result into below table?

csahoo
Explorer

index="*dockerlogs*" source="*gps-request-processor-dev*" OR source="*gps-external-processor-dev*" OR source="*gps-artifact-processor-dev*"
| eval LabelType=coalesce(labelType, documentType)
| stats count(eval(status="Received" AND source like "%gps-request-processor%" )) as received count(eval(status="Failed")) as failed by LabelType


LabelType               Received            Failed
----------                      --------                 ------
CARRIERLABEL       2                          2
NIKE                            39                        35
TASKSTART             1                           0


i want to transform above result into below table

1) where category can be 'external' or 'internal'
      if labeltype is 'CARRIERLABEL' then category is 'external' else for other labeltype it should be 'internal'

2)  successcount = Received - failed


category               successcount
--------                    -------------
external                0
internal                 5

Labels (7)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index="*dockerlogs*" source="*gps-request-processor-dev*" OR source="*gps-external-processor-dev*" OR source="*gps-artifact-processor-dev*"
| eval LabelType=coalesce(labelType, documentType)
| stats count(eval(status="Received" AND source like "%gps-request-processor%" )) as received count(eval(status="Failed")) as failed by LabelType
| eval category=if(LabelType="CARRIERLABEL","external","internal")
| eval successcount = received - failed
| stats sum(successcount) as successcount by category

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
index="*dockerlogs*" source="*gps-request-processor-dev*" OR source="*gps-external-processor-dev*" OR source="*gps-artifact-processor-dev*"
| eval LabelType=coalesce(labelType, documentType)
| stats count(eval(status="Received" AND source like "%gps-request-processor%" )) as received count(eval(status="Failed")) as failed by LabelType
| eval category=if(LabelType="CARRIERLABEL","external","internal")
| eval successcount = received - failed
| stats sum(successcount) as successcount by category
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...