Splunk Search

How to use Stats command ?

m7787580
Explorer

Hi Splunker,

I have a logs which has
Defect ID ,Actual Fix Time Taken,Detected By,Priority.

I would like to calculate maximum value of Actual Fix time taken by each Priority and simultaneously i would like to see the Defect Id as well
My output should look like that

Priority    Defect ID   Detected by Maximum Actual Fix time(In days)
P1           1234            x                 2
P2           767              Y                5
P3           122              z                20
P4           3526            T                 67

Note:- Actual Fix time means time taken to fix the defect and here i would like to know the Defect ID for which maximum time taken to close that defect against each priority.

I tried using below mentioned query

source="Jcaps_Logs.csv" index="jcaps" sourcetype="csv"

| fillnull value=NULL "Actual Fix Time"
| search "Actual Fix Time"!=NULL
| stats max("Actual Fix Time") as maxy by "Priority","Defect ID"

Thanks in advance

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

source="Jcaps_Logs.csv" index="jcaps" sourcetype="csv"
| fillnull value=-1 "Actual Fix Time" 
| sort 0 Priority -"Actual Fix Time"
| dedup Priority
| table Priority "Defect ID" "Detected By" "Actual Fix Time" 
| eval "Actual Fix Time"=if('Actual Fix Time'=-1,"NULL",'Actual Fix Time")
| rename "Actual Fix Time" as "Maximum Actual Fix time(In days)"

View solution in original post

somesoni2
Revered Legend

Try like this

source="Jcaps_Logs.csv" index="jcaps" sourcetype="csv"
| fillnull value=-1 "Actual Fix Time" 
| sort 0 Priority -"Actual Fix Time"
| dedup Priority
| table Priority "Defect ID" "Detected By" "Actual Fix Time" 
| eval "Actual Fix Time"=if('Actual Fix Time'=-1,"NULL",'Actual Fix Time")
| rename "Actual Fix Time" as "Maximum Actual Fix time(In days)"

m7787580
Explorer

Many thanks somesoni2

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...