Splunk Search

Grouping result after stats

SplunkBaby
Explorer

Hi
I have a search like this
host=A |stats last("Status") by TaskId

I like to group the result of above query by Status and then display a pie chart.
I use transaction "Status" but doesn't work out.
Can anybody help me.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

In addition to Rocket66's comment, try this: 'host=A | stats last("Status") as LastStatus by TaskId | chart LastStatus'.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

SplunkBaby
Explorer

Thanks it is solved

0 Karma

SplunkBaby
Explorer

I get the result.Result is based on TaskIds.
I want to group that result again based on Status.
for that i use like
host=A |stats last("Status") by TaskId | transaction "Status".
This is not working.How can i achieve this.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

In addition to Rocket66's comment, try this: 'host=A | stats last("Status") as LastStatus by TaskId | chart LastStatus'.

---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

Please accept the answer if it is what got it worked out.

---
If this reply helps you, Karma would be appreciated.
0 Karma

SplunkBaby
Explorer

This worked out .Thanks man

0 Karma

Rocket66
Communicator

Don't know, what the problem is ...

  • do you get no results (as a list)?
  • you get results but, the pie chart is rendered with wrong or no values?

Maybe your field "Status" is called "status" or "TaskId", "TaskID" or some (other) typo?

Greetz, Robert

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...