Hello Splunkers!!
I need the results as per the below format. I have tried some SPL but not achieved with the expected results. Please help me to achieve the same.
Order Status | AU | NZ | UK | |
02:00:00 | created. | 10 | 11 | 12 |
released | 9 | 8 | 6 | |
shipped | 6 | 7 | 4 | |
AU | NZ | UK | ||
03:00:00 | created. | 10 | 11 | 12 |
released | 9 | 8 | 6 | |
shipped | 6 | 7 | 4 |
What I have done so far In SPL :
index="ABC "OrderStatus=created" OR "OrderStatus=Shipped" OR "OrderStatus=Released" OR "OrderStatus=Cancelled"
| rex field=_raw "SellerOrganizationCode\=one\_(?<Market>[A-Z]{2})"
| search NOT (Market="CA" OR Market="US" OR Market="KO" OR Market="SE" OR Market="NL" OR Market="IE" OR Market="NO" OR Market="LA")
| replace CH WITH EU GB WITH UK
| bin _time span=1h
| eval Time=strftime(_time,"%m/%d-%y %H:%M:%S.%Q %p")
| eval newtime=strptime(Time,"%m/%d-%y %H:%M:%S.%Q %p")
| eval Time_Hour=strftime(newtime,"%m/%d/%Y %H:%M")
| chart count by Time_Hour,Market usenull=f
| addtotals col=true row=true label=Total labelfield=Time_Hour
| rename Total as "Total orders for the hour"