Refine your search:

I have the following search used to gather data which is used later in a hiddenpostprocess search :

index=blah | stats count by Product_Group, Application, Severity, _time

My postprocessing seach is :

stats sum(count) AS Count by Product_Group Severity

Which outputs the data in a multiline per product format. ie.

Product_Group Severity Count
A   Major   1
B   Major   1
C   Major   6
C   Minor   1
D   Minor   2
E   Minor   1
F   Critical 92
F   Major   117

3 columns. Product_group Severity and count.

I would like to format the data like this.

Product_Group Critical Major Minor
A 0 1 0
B 0 1 0
C 0 6 1
D 0 0 2
E 0 0 1
F 92 117 0

Prior to using postprocessing a search that would provides the format I want would be :

stats sum(eval(Severity="Critical")) AS Critical, sum(eval(Severity="Major")) AS Major, sum(eval(Severity="Minor")) AS Minor by Product_Group | sort - num(Critical)

Is it possible to use an eval within a stats sum(count)? Anytime I try to do an eval inside that I get zero values.

edit #1: Tried using a chart command

| stats sum(count) AS Count by Product_Group Severity | chart Count over Product_Group by Severity

But it is not fed the correct data so its wrong (but right visual format however!).

asked 23 May '12, 21:14

Lucas%20K's gravatar image

Lucas K
62338
accept rate: 37%

edited 23 May '12, 21:56


One Answer:

i was close with my first edit.

The solution for those playing at home.

chart sum(count) AS Count over Product_Group by Severity

So simple facepalm.

link

answered 23 May '12, 21:58

Lucas%20K's gravatar image

Lucas K
62338
accept rate: 37%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×279
×248
×151
×36

Asked: 23 May '12, 21:14

Seen: 1,468 times

Last updated: 23 May '12, 21:58

Copyright © 2005-2012 Splunk Inc. All rights reserved.