Splunk Search

How can I show the total count as well as completed count?

akshaypillai
Engager

If I have to show that 8 out of 10 tickets have been closed how can I best show this? I need to show the total count as well as completed count

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should get you started. You'll likely need to change the eval expression to whatever indicates a closed ticket.

<your base search for all tickets> | stats count(eval(status=Closed)) as closed, count as total | eval "Percentage Closed"=(closed*100)/total | rename closed as "Tickets Closed", total as "Total Tickets" | table "Tickets Closed" "Total Tickets" "Percentage Closed"
---
If this reply helps you, Karma would be appreciated.
0 Karma

elliotproebstel
Champion

One way to visually represent this would be to create a statistics table like this (with the percentage column optional, but nice to have):

Tickets Closed | Total Tickets | Percentage Closed
8              | 10            | 80%

Alternately, you could make a dashboard with two single items (or three, if you wanted the percentage), one for each value. And another way that would make sense to present that data would be a pie chart.

0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...