Have working query to give me list of all printers, total job count, total page count and show location of printers using a lookup. Sample Data, Lookup and query is: Sample Data print logs from ...
See more...
Have working query to give me list of all printers, total job count, total page count and show location of printers using a lookup. Sample Data, Lookup and query is: Sample Data print logs from index=printer prnt_name jobs pages_printed size_paper CS001 1 5 letter CS001 1 10 11x17 CS002 1 20 11x17 CS003 1 10 letter CS003 1 15 11x17 Lookup Data from printers.csv prnt_name location CS001 office CS002 dock CS003 front Splunk Query index=printer | stats count sum(pages_printed) AS tot_prnt_pgs by prnt_name, | lookup printers.csv prnt_name AS prnt_name OUTPUT location | stats sum(count) AS print_jobs by prnt_name | table prnt_name, location, count, tot_prnt_pgs Splunk Query Results prnt_name location count tot_prnt_pgs CS001 office 2 15 CS002 dock 1 20 CS003 front 2 25 I have been trying to use a (count (eval(if...))) clause but not sure how ot implement it or if that is the correct way to get the results I am after. I have been using various arguments from other Splunk posts but can't seem to make it work. Below is the output I am trying to get Output looking for: "ltr" represents letter and lgl represents 11x7. prnt_name location count tot_prnt_pgs ltr_count ltr_tot_pgs lgl_count lgl_tot pgs CS001 office 2 15 1 5 1 10 CS002 dock 1 20 0 0 1 20 CS003 front 2 25 1 10 1 15 Appreciate any time give on this.