Splunk Search

grouping data in search

joegrossman
Explorer

I am serching a log that has statuses. When I run the search and chart it, I get a bar for each status. There are, say, 10 statuses. Instead, I want to group the data into 2 results: one result is the count of status < 400, and the other is the count of status >= 400. Any idea how I get this?

Tags (1)

kristian_kolb
Ultra Champion

Like this.

   ... | stats c(eval(status<400)) AS low c(eval(status>=400)) AS high 

Please note that you need to rename the fields with AS like above.

EDIT: changed so that the exact value of 400 would be counted as 'high'.

Hope this helps,

Kristian

kristian_kolb
Ultra Champion

Good to hear. Please mark as answered and/or upvote. Thanks, Kristian

0 Karma

joegrossman
Explorer

Thanks Kristian! This worked. I tweaked it a bit because I hadn't put my question clearly, but your syntax worked. Here is what I ended up with:
...| timechart c(eval(status>400)) AS FAILURE c(eval(status<=400)) AS SUCCESS

0 Karma

mwhite_splunk
Splunk Employee
Splunk Employee

Can you please paste the search you are currently using to do this?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...