Hi, we have csv file in below format.
WEB_xxxx David PASSED
WEB_xxxx Rapkin FAILED
WEB_xxxx Rapkin PASSED
WEB_xxxx Diana PASSED
DC_xxxx John FAILED
PROMOTE_xxxx Paul PASSED
AST_xxxx John PASSED
Would like to generate report as below. Basically we would like to group projects based on their prefix and have a count for each group.
PROJECT: COUNT PASSED FAILED
WEB 4 3 1
DC 1 0 1
PROMOTE 1 1 0
AST 1 1 0
Try this:
... | rex "^(?<PROJECT>[^_]*)_[\S]*\s+(?<USER>[\S]*)\s+(?<STATUS>[\S]*) | stats count AS COUNT count(eval(STATUS="PASSED)) AS PASSED BY PROJECT | eval FAILED = COUNT - PASSED
How is this different from this question? http://splunk-base.splunk.com/answers/34471/field-value-count