Splunk Search

grouping data in search

Explorer

I am serching a log that has statuses. When I run the search and chart it, I get a bar for each status. There are, say, 10 statuses. Instead, I want to group the data into 2 results: one result is the count of status < 400, and the other is the count of status >= 400. Any idea how I get this?

Tags (1)

Ultra Champion

Like this.

   ... | stats c(eval(status<400)) AS low c(eval(status>=400)) AS high 

Please note that you need to rename the fields with AS like above.

EDIT: changed so that the exact value of 400 would be counted as 'high'.

Hope this helps,

Kristian

Ultra Champion

Good to hear. Please mark as answered and/or upvote. Thanks, Kristian

0 Karma

Explorer

Thanks Kristian! This worked. I tweaked it a bit because I hadn't put my question clearly, but your syntax worked. Here is what I ended up with:
...| timechart c(eval(status>400)) AS FAILURE c(eval(status<=400)) AS SUCCESS

0 Karma

Splunk Employee
Splunk Employee

Can you please paste the search you are currently using to do this?

0 Karma