Splunk Search

how to create table for multiple data?


I need to create a table which will display

workweek as rows

and subarea as column, meanwhile the data inside will display the passing percentage for each subarea for every workweek.

i tried

*|stats count(eval(status="Failed")) AS fail,count(eval(status="Passed")) AS pass by workweek|eval passPercentage=if(pass+fail== 0, "-",round(pass/(pass+fail)*100,2))|fields workweek,passPercentage

This will only calculate for overall passPercentage for each workweek, but i want it to be done with each subarea of each workweek...

0 Karma

Splunk Employee
Splunk Employee

what about creating a field for your subarea and use it as a new by condition ?

| eval subarea=case(status="Passed","pass",status="Failed","fail",1=1,"other")
|chart count over workweek by subarea
| eval total=pass+fail
|eval passPercentage=if(total== 0, "-",round(pass/(total)*100,2))
|fields workweek,passPercentage


thank you yannK,
but i still cant get the things that i want =(

my data should display something like this

             subArea1 subArea2 subArea3...

workweek1 12 32 88
workweek2 96 45 12
workweek3 23 78 43
workweek4 37 79 98

0 Karma