Splunk Search

nomv similar values with count

niyaz006
Path Finder

I have data like below,

TaskName - Status
Task 1 - New
Task 1 - Running
Task 1 - Running
Task 1 - Pause
Task 1 - Running
Task 1 - Done

I want the output to be,
New(1) - Running(2) - Pause(1) - Running(1) - Done(1).

I was able to get New - Running - Running - Pause - Running - Done with the below query,

index="default" | stats list(status) as status delim=" - " by task | nomv status
0 Karma

koshyk
Super Champion

But how are you going to differentiate the Running(2) and Running(1) in the 3rd occurence? Its same Task as well, so you want to do transaction when the job state changes?

0 Karma

niyaz006
Path Finder

I want to figure out how many statuses each task changes before it gets completed. That way, we want to categorize the simple running jobs without much status changes... and ones which undergo lot of status changes (it could be that there are manual interventions required). So we can try and figure out which one can be automated and which ones require optimization.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...