Splunk Search

nomv similar values with count

niyaz006
Path Finder

I have data like below,

TaskName - Status
Task 1 - New
Task 1 - Running
Task 1 - Running
Task 1 - Pause
Task 1 - Running
Task 1 - Done

I want the output to be,
New(1) - Running(2) - Pause(1) - Running(1) - Done(1).

I was able to get New - Running - Running - Pause - Running - Done with the below query,

index="default" | stats list(status) as status delim=" - " by task | nomv status
0 Karma

koshyk
Super Champion

But how are you going to differentiate the Running(2) and Running(1) in the 3rd occurence? Its same Task as well, so you want to do transaction when the job state changes?

0 Karma

niyaz006
Path Finder

I want to figure out how many statuses each task changes before it gets completed. That way, we want to categorize the simple running jobs without much status changes... and ones which undergo lot of status changes (it could be that there are manual interventions required). So we can try and figure out which one can be automated and which ones require optimization.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...