About Atif

Atif · ‎09-17-2021

Hi Folks, My test data are like : DOC_ID,PROCESS_ID,RECEIVER DOC_10,PROC_A100,REC_0001 DOC_10,PROC_A100,REC_0002 DOC_20,PROC_A100,REC_0001 DOC_30,PROC_A100,REC_0001 DOC_50,PROC_A200,REC_0001 DOC_60,PROC_A200,REC_0001 stats count by PROCESS_ID,RECEIVER : PROCESS_ID,RECEIVER,count PROC_A100,REC_0001,3 PROC_A100,REC_0002,1 PROC_A200,REC_0001,2 I would like to append the total of distinct DOC_ID for each PROCESS_ID : TOTAL_OF_DOCS first line is 3, because PROC_A100 has DOC_10+DOC_20+DOC_30 TOTAL_OF_DOCS second line is 2, because PROC_A200 has DOC_50+DOC_60 Any hints are welcome. With kind regards

Atif · ‎07-21-2021

Dear Splunkers, The result of my search is like : TXID,STATUS_A,STATUS_B,STATUS_C A,OK,OK,OK B,OK,KO,INPROGRESS C,OK,OK,KO D,OK,KO,KO E,KO Transaction E has no STATUS_B nor STATUS_C fields What i'am trying to get is a count over all STATUS columns : STATUS_NAME,OK_COUNT,KO_COUNT,INPROGRESS_COUNT STATUS_A,4,1,0 STATUS_B,2,2,0 STATUS_C,1,2,1 Any hints are welcome. Thank you

Atif · ‎06-08-2021

Well i have have done this, it is working but i think there is a better more optimised solution : | transaction TXID mvlist=true | eval RECEIVER_STATUS=mvzip(RECEIVER,STATUS) | eval DEDUP_RECEIVER_STATUS=mvdedup(RECEIVER_STATUS) | eval RECEIVER_OK=mvfilter(match(DEDUP_RECEIVER_STATUS, "RCV00001,OK$") OR match(DEDUP_RECEIVER_STATUS, "RCV00002,OK$")) | eval JOINED_RECEIVER_OK=mvjoin(RECEIVER_OK, ";") | eval OK_GLOBAL_STATUS=if(JOINED_RECEIVER_OK=="RCV00001,OK;RCV00002,OK" OR JOINED_RECEIVER_OK=="RCV00002,OK;RCV00001,OK","OK", "NA") | eval RECEIVER_DEDUP=mvdedup(RECEIVER) | eval RECEIVER_DEDUP_COUNT=mvcount(RECEIVER_DEDUP) | eval ONGOING_GLOBAL_STATUS=if(RECEIVER_DEDUP_COUNT!=2,"ONGOING","NA") | eval GLOBAL_STATUS=if(OK_GLOBAL_STATUS=="NA" AND ONGOING_GLOBAL_STATUS=="NA","KO",if(OK_GLOBAL_STATUS=="NA",ONGOING_GLOBAL_STATUS,if(RECEIVER_DEDUP_COUNT!=2,"ONGOING",OK_GLOBAL_STATUS))) | eval TXID=mvdedup(TXID) | table TXID GLOBAL_STATUS

Atif · ‎06-08-2021

Hi @ITWhisperer , any hint on this 😊 ? Thank you

Atif · ‎06-04-2021

Thank you @ITWhisperer for your feedback. I have tried your hint but i'am not getting the first line as expected :

Atif · ‎06-03-2021

Hi, I have some events like : --------------------------------- TXID;RECEIVER;STATUS AA11;RCV00001;OK AA11;RCV00001;KO AA11;RCV00002;OK AA22;RCV00001;OK AA22;RCV00002;OK AA22;RCV00002;KO AA33;RCV00001;KO AA33;RCV00001;KO AA33;RCV00001;OK AA33;RCV00002;KO AA33;RCV00002;OK AA44;RCV00001;KO AA44;RCV00002;KO AA55;RCV00001;OK AA66;RCV00001;KO AA77;RCV00001;OK AA77;RCV00001;OK AA77;RCV00001;KO AA88;RCV00001;KO AA88;RCV00001;OK AA99;RCV00001;OK AA99;RCV00001;KO AA1Z;RCV00001;KO AA1Z;RCV00001;KO AA1Z;RCV00002;OK AABH;RCV00001;OK AABH;RCV00002;OK AAKK;RCV00001;OK AAKK;RCV00002;OK AAKK;RCV00001;OK AAYY;RCV00001;OK AAYY;RCV00002;OK AAYY;RCV00002;OK AAPO;RCV00001;OK AAPO;RCV00001;KO AAPO;RCV00002;OK AAPO;RCV00002;KO AAML;RCV00001;KO AAML;RCV00001;OK AAML;RCV00002;KO AAML;RCV00002;OK AAOO;RCV00001;OK AAOO;RCV00001;KO AAOO;RCV00002;KO AAOO;RCV00002;OK AATR;RCV00001;KO AATR;RCV00001;KO AATR;RCV00002;KO AATR;RCV00002;OK AAFA;RCV00001;OK AAFA;RCV00001;OK AAFA;RCV00002;KO AAFA;RCV00002;OK AAWW;RCV00002;OK AAWW;RCV00001;KO AAWW;RCV00002;OK AAHZ;RCV00001;KO AAHZ;RCV00002;OK AAHZ;RCV00001;OK ---------------------------- I need to calculate a global status for each transaction. Here you are the rules : each transaction must have RCV00001 and RCV00002 : if it has only one RECEIVER then the global status is => ONGOING the global status of a transaction is OK only if : it has at least one RCV00001 with OK status + at least one RCV00002 with OK status else the global status is KO As a result we should get : TXID;GLOBAL_STATUS AA11;OK AA22;OK AA33;OK AA44;KO AA55;ONGOING AA66;ONGOING AA77;ONGOING AA88;ONGOING AA99;ONGOING AA1Z;KO AABH;OK AAKK;OK AAYY;OK AAPO;OK AAML;OK AAOO;OK AATR;KO AAFA;OK AAWW;KO AAHZ;OK Thank you for your help, Best regards

Atif · ‎05-28-2021

Hi, I'am sending some events each minute to Splunk : TIME ID IN OUT 08:00 A 1 0 08:00 B 0 0 08:01 A 2 1 08:01 B 2 2 08:01 C 4 0 08:02 A 3 3 08:02 B 3 2 08:03 A 6 4 08:03 B 3 3 08:04 A 6 4 08:04 B 3 3 08:04 C 4 2 08:05 A 6 4 08:05 B 3 3 08:05 C 4 2 What i'am trying to get as a result is : TIME SUMIN - PREVIOUS_SUMIN SUMOUT - PREVIOUS_SUMOUT 08:00 =1+0 = 1 =0+0 = 0 08:01 =2+2+4 - (1+0) = 7 =1+2+0 - (0+0) = 3 08:02 =3+3 - (2+2+4) = -2 =3+2 - (1+2+0) = 2 08:03 =6+3 - (3+3) = 3 =4+3 - (3+2) = 2 08:04 =6+3+4 - (6+3) = 4 =4+3+2 - (4+3) = 2 08:05 =6+3+4 - (6+3+4) = 0 =4+3+2 - (4+3+2) = 0 After that i need to plot the two columns using a timechart by TIME Any hints are welcome. Thank you guys

Posts	7
Solutions	1
Karma Given	2
Karma Received	0
Member Since	‎05-28-2021

Online Status	Offline
Date Last Visited	‎09-29-2021 05:41 AM

Multiple stats count

Columns to rows and count

Transaction global status

Perform SUM and DIFF on multiple fields

Multiple stats count

Columns to rows and count

Re: Transaction global status

Re: Transaction global status

Re: Perform SUM and DIFF on multiple fields

Transaction global status

Perform SUM and DIFF on multiple fields