Splunk Search

nomv similar values with count

niyaz006
Path Finder

I have data like below,

TaskName - Status
Task 1 - New
Task 1 - Running
Task 1 - Running
Task 1 - Pause
Task 1 - Running
Task 1 - Done

I want the output to be,
New(1) - Running(2) - Pause(1) - Running(1) - Done(1).

I was able to get New - Running - Running - Pause - Running - Done with the below query,

index="default" | stats list(status) as status delim=" - " by task | nomv status
0 Karma

koshyk
Super Champion

But how are you going to differentiate the Running(2) and Running(1) in the 3rd occurence? Its same Task as well, so you want to do transaction when the job state changes?

0 Karma

niyaz006
Path Finder

I want to figure out how many statuses each task changes before it gets completed. That way, we want to categorize the simple running jobs without much status changes... and ones which undergo lot of status changes (it could be that there are manual interventions required). So we can try and figure out which one can be automated and which ones require optimization.

0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...