Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About repo12
repo12
New Member
Member since:
02-01-2017
06-05-2020
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 02-01-2017 |
Activity Feed
- Posted Re: How to get the count of events per value on Splunk Search. 02-21-2017 08:53 AM
- Posted Re: How to get the count of events per value on Splunk Search. 02-19-2017 11:34 AM
- Posted How to get the count of events per value on Splunk Search. 02-19-2017 07:12 AM
- Tagged How to get the count of events per value on Splunk Search. 02-19-2017 07:12 AM
- Posted Re: how to get the count of transactions monthly where Transaction_Date is greater than 01/01/2016 ? on Splunk Search. 02-10-2017 07:33 AM
- Posted Re: how to get the count of transactions monthly where Transaction_Date is greater than 01/01/2016 ? on Splunk Search. 02-10-2017 06:52 AM
- Posted how to get the count of transactions monthly where Transaction_Date is greater than 01/01/2016 ? on Splunk Search. 02-09-2017 03:58 PM
- Tagged how to get the count of transactions monthly where Transaction_Date is greater than 01/01/2016 ? on Splunk Search. 02-09-2017 03:58 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
02-19-2017
11:34 AM
Thanks a lot for the answer.
Also, based on the data in my 1st question, How can I get the count of Cust_Id's which has Status = 'Delivery failed' and Status = 'Delivery delayed' ? Is there a way to generate a graph showing the actual count to cust_id's and cust_id's with Status = 'Delivery failed' and Status = 'Delivery delayed' (i.e to show what percent of cust_id's have Status = 'Delivery failed' and Status = 'Delivery delayed').
Thanks !
... View more
02-19-2017
07:12 AM
I have two fields, cid Status and delivery_date. How could I get the total unique count of cids which has Status as DeliveryFailed. My data has multiple values of status as DeliveryFailed for a cid but I would like to get the count only once per cid. Data type of delivery_date is date. following is my sample data
cid=1 Status = 'Delivery failed' delivery_date = 2015-01-01
cid=1 Status = 'Delivery delayed' delivery_date = 2015-02-01
cid=1 Status = 'Delivery failed' delivery_date = 2015-03-01
cid=1 Status = 'Delivery failed' delivery_date = 2015-04-01
cid=2 Status = 'Delivery failed' delivery_date = 2015-01-01
cid=2 Status = 'Delivery failed' delivery_date = 2015-04-01
For the above data I would like to get the TotalDliveryFailedcount as only '2' (1 for cid=1 (even though it has 3 'Delivery failed' events) and 1 for cid=2 (event though it has 2 'Delivery failed' events)
Also, if I have another column phonestatus which have values such as invalid and valid. How can I get get the count of custid's which has
atleast one event with status as 'DeliveryFailed' and phone status as 'invalid'
cid=1 Status = 'Delivery failed' phonestatus="Invalid" delivery_date = 2015-01-01
cid=2 Status = 'Delivery failed' phonestatus="Valid" delivery_date = 2015-01-01
cid=3 Status = 'Delivery failed' phonestatus="InValid" delivery_date = 2015-01-01
I would like the output to be Total (DelvieryFailed and Invalid) =2 (i.e cid=1 and cid=3)
Any help is appreciated. Thank you.
... View more
- Tags:
- splunk-enterprise
02-10-2017
07:33 AM
Thanks for the above suggestions. Date comparison is not working as expected. TransactionDate has Date as the datatype. I want to get the transaction count for a given month. I tried with the following but it returns the count for months prior to 2016-01-01
| eval Transaction_Date = strptime(Transaction_Date,"%Y-%m-%d")
| eval startDate = strptime("2016-01-01","%Y-%m-%d")
| where Transaction_Date > startDate
| bucket span=1month _time
| stats count(startDate) by _time
How could I get the transaction count for a given month where TransactionDate (DataType - Date) is greater than 2016-01-31?
Expected results should be like the following
_time TransactionCount
2016-02 295
2016-03 300
2016-04 250
... View more
02-10-2017
06:52 AM
Thanks for the above suggestions. Date comparison is not working as expected. TransactionDate has Date as the datatype. I want to get the transaction count for a given month. I tried with the following but it returns the count for months prior to 2016-01-01
| eval Transaction_Date = strptime(Transaction_Date,"%Y-%m-%d")
| eval startDate = strptime("2016-01-01","%Y-%m-%d")
| where Transaction_Date > startDate
| bucket span=1month _time
| stats count(startDate) by _time
How could I get the transaction count for a given month where TransactionDate (DataType - Date) is greater than 2016-01-31?
Expected results should be like the following
_time TransactionCount
2016-02 295
2016-03 300
2016-04 250
... View more
02-09-2017
03:58 PM
I have fields like Transaction_Date and Status. How Can I get the count of transactions which where active (i.e Status=Active) where Transaction_Date > 2016-01-01. I tried the following and I am only getting the transactioncount for each day after 2016-01-01
status=Active Transaction_Date > 2016-01-01 |stats count as 'ActiveTransactions' by Transaction_Date
Also, how can I get the transaction count between 2 Dates (i.e Transaction_Date between 2016-01-01 and 2016-05-01)
Any help is Appreciated. Thank you !
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
