Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Stats Sum/Count

$
0
0
Hi, I wonder whether someone can help me please. I've put together the following query: w2_wmf(RequestCompleted)`request.detail.Context="*test" | dedup eventId | rename request.ClientId as ClientID | stats count(eval('detail.statusCode')) as "All", sum(eval('detail.statusCode'<=303)) as "Successful", sum(eval('detail.statusCode'>303)) as "Unsuccessful" by ClientID Which outputs as follows: **ClientID** **All** **Successful** **Unsuccessful** 1111111 3 2 1 What I'd like to do is to expand this and then show all the status codes as column headings after the "Unsuccessful" column heading with the respective counts but for he life of me I can't find the solution. Could someone possible look into this and offer some guidance on how I may be able to do this? Many thanks and kind regards Chris

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>