Splunk根据字段中的不同值创建具有计数的表

Question

我正试图创建一个表，用splink计算列表中的项目。

例如，我有一个项目列表，其中一个项目具有以下字段：

• 名称
• 类型
• 结果(例如只有成功、失败和N.A.三个值(

我希望创建一个表，将项目分组到各自的名称中，然后计算属于该名称的项目数，并列出包含项目集的组的各自类型。之后，我希望具有基于"；标签"；属性

以下是我希望实现的示例表格式：

name      | type       | success | failure | N.A. | Total count
Item A    | fruits     |    5    |   0     |   1  |     6
Item B    | vegetables |    0    |   2     |   3  |     5
Item C    | sweets     |    1    |   3     |   2  |     6

以下是我在splink命令参考中查找后尝试的内容：

index="The index I am looking for" | stats count, values(fields.type) as type by fields.name | table fields.name, Type, count | rename fields.name as name, count as "Total Count"
| appendcols [search index="The index I am looking for" fields.result="success" | stats count, values(fields.type) as type by fields.name | table fields.name, Type, count | rename fields.name as name, count as "success"] 
| appendcols [search index="The index I am looking for" fields.result="failure" | stats count, values(fields.type) as type by fields.name | table fields.name, Type, count | rename fields.name as name, count as "failure"]
| appendcols [search index="The index I am looking for" fields.result="N.A." | stats count, values(fields.type) as type by fields.name | table fields.name, Type, count | rename fields.name as name, count as "N.A."]

我注意到，对于某些列，例如标题为"；"故障"；，没有将它们的行与其他行对齐，导致total count列与要相加的行中的所有计数不匹配。

例如，参考前面的表格，使用我创建的搜索查询，生成下表：

name      | type       | success | failure | N.A. | Total count
Item A    | fruits     |    5    |   2     |   1  |     6
Item B    | vegetables |    0    |   3     |   3  |     5
Item C    | sweets     |    1    |   0     |   2  |     6

如果能就如何改进搜索查询提供建议，或者如果可能的话，纠正我使用的更合适的命令，我将不胜感激。

Answer 1

正如您所发现的，appendcols命令在某些有限的情况下正常工作。来自CCD_ 2的结果的顺序和计数必须与来自主搜索和其他CCD_；排队"；。

一种解决方案是使用append命令，然后使用stats对结果重新分组。

index=foo 
| stats count, values(fields.type) as Type by fields.name 
| fields fields.name, Type, count 
| rename fields.name as name, count as "Total Count"
| append [search index=foo fields.result="success" 
| stats count, values(fields.type) as Type by fields.name 
| fields fields.name, Type, count 
| rename fields.name as name, count as "success"] 
| append [search index=foo fields.result="failure" 
| stats count, values(fields.type) as Type by fields.name 
| fields fields.name, Type, count 
| rename fields.name as name, count as "failure"]
| append [search index=foo fields.result="N.A." 
| stats count, values(fields.type) as Type by fields.name 
| fields fields.name, Type, count 
| rename fields.name as name, count as "N.A."]
| stats values(*) as * by name
| table fields.name, Type, count 

另一种解决方案完全避免使用append。

index=foo 
| rename fields.* as *
| stats count as "Total Count", 
sum(eval(result="success")) as success,
sum(eval(result="failure")) as failure, 
sum(eval(result="N.A.")) as "N.A.", 
values(type) as Type by name 
| table name, Type, success, failure, "N.A.", "Total Count"

构造sum(eval(<<expression>>))对<<expression>>为真的结果进行计数。