Hello - I'd like to start with thanking the community for reviewing and helping! Problem Statement: I have appt data from multiple clinical locations in Splunk with different types statues. I am trying to create a dashboard that would show trends in appts requests to see if we're gaining pts or losing them, what days are the busiest, what days are the slowest. Query:
index="index" cluster_id="*" dump_info:98
| spath output=log path=log
| rex field=log ".*\{\'name\'\:\s\'(?<name>.*)\'\,\s\'service_type\'\:\s\'(?<service_type>.*)\'\,\s\'status\'\:\s\'(?<status>.*)\'\,\s\'start\'\:\s\'(?<start>.*)\'\,\s\'lastUpdated\'\:\s\'(?<lastUpdated>.*)\'\,\s\'date\'\:\s\'(?<date>.*)\'\}"
| search name="*" AND status="*" AND start="*"
| dedup name service_type status start lastUpdated date
| eval startdate=strftime(strptime(start,"%Y-%m-%dT%H:%M:%SZ"),"%Y-%m-%d"), today=strftime(now(),"%Y-%m-%d")
| where startdate=today
| table name, status
| stats count(status) as status_count, values(*) as * by name, status
... View more