Multiple stats counts on different criteria

[guythomasdavis]

Hi all, first question on Splunk Answers. I just finished the Fundamentals I training and am now wanting to do some more sophisticated things with the SPL. I have data with status codes 100-900 that tracks the progress of a process that happens daily. I'd like to do a chart that is on a dashboard where dynamic updates happen that shows the progress. So for each client (field), that has a operationnumber i want to be able to show the total operations being processed (max status < 900) for that client and the total complete for that client (max status = 900) ... something like head limit=1 for each client, operationnumber where the items are sorted by - status.

While I understand the basics of the SPL there is something i'm not quite getting about how the SPL searches are parsed and executed... e.g. the light bulb has yet to fully go off! I'm actually looking forward to really grokking this so I can start helping others here.

Thanks so much,

Guy Davis

[woodcock]

Like this:

Your base search hear that gets all the events
| stats count AS total count(eval(max_status<900)) AS count_below_900 count(eval(max_status==900)) AS count_equals_900 BY process client

[guythomasdavis]

thank you. as soon as i finish using eventgen to generate some sample data and test i'll let you know how this works. i'll hopefully have this done in a couple of days.

[FrankVl]

Can you provide a bit more information on what the data looks like and what the key fields are that you want to look at?

If I understand your question correctly I think you need to do something like this (assuming you have some process field that identifies the processes), if you provide some sample data or some more info on the relevant fields, I can make the answer more tailored to your situation.

...your base search...
| stats max(status) as max_status by process,client
| eval status = if(max_status=900,"Complete","In Progress")
| stats count by status,client

[guythomasdavis]

Hi, I'm working with eventgen as this data hasn't been generated as of yet. I will post it here when I am finished. I appreciate your feedback to date