Splunk Search

Multiple stats counts on different criteria

guythomasdavis
Explorer

Hi all, first question on Splunk Answers. I just finished the Fundamentals I training and am now wanting to do some more sophisticated things with the SPL. I have data with status codes 100-900 that tracks the progress of a process that happens daily. I'd like to do a chart that is on a dashboard where dynamic updates happen that shows the progress. So for each client (field), that has a operationnumber i want to be able to show the total operations being processed (max status < 900) for that client and the total complete for that client (max status = 900) ... something like head limit=1 for each client, operationnumber where the items are sorted by - status.

While I understand the basics of the SPL there is something i'm not quite getting about how the SPL searches are parsed and executed... e.g. the light bulb has yet to fully go off! I'm actually looking forward to really grokking this so I can start helping others here.

Thanks so much,

Guy Davis

Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

Your base search hear that gets all the events
| stats count AS total count(eval(max_status<900)) AS count_below_900 count(eval(max_status==900)) AS count_equals_900 BY process client
0 Karma

guythomasdavis
Explorer

thank you. as soon as i finish using eventgen to generate some sample data and test i'll let you know how this works. i'll hopefully have this done in a couple of days.

0 Karma

FrankVl
Ultra Champion

Can you provide a bit more information on what the data looks like and what the key fields are that you want to look at?

If I understand your question correctly I think you need to do something like this (assuming you have some process field that identifies the processes), if you provide some sample data or some more info on the relevant fields, I can make the answer more tailored to your situation.

...your base search...
| stats max(status) as max_status by process,client
| eval status = if(max_status=900,"Complete","In Progress")
| stats count by status,client

guythomasdavis
Explorer

Hi, I'm working with eventgen as this data hasn't been generated as of yet. I will post it here when I am finished. I appreciate your feedback to date

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...