topic Re: Group Different Sources in One Query in Splunk Enterprise

Group Different Sources in One Query

a0491455 — Wed, 14 Jul 2021 14:32:07 GMT

Hello,

I'm running Splunk 8.1.2 and I'm trying to group different sources of an Index to count them within one query.

The following fields are what I'm trying to group:
index: license_compliance

fields:
- prod

- dev

- other (anything that does not end in prod or dev)

index=license_compliance OR source="/license_compliance-splunk-data/iCinga_ingest/*" | rex field=source "\/license_compliance-splunk-data\/iCinga_ingest\/(?<log_source>\w)" | eval log_source="iCinga_ingest".log_source | stats dc(source) | dedup source, name | timechart span=1d count(name) by source

The data looks like this currently:

"/license_compliance-splunk-data/iCinga_ingest/iCingaDev_2021-07-07.csv"

I would like to get something like this:

07/07: iCinga_Prod: 5 iCinga_Dev: 0 iCinga_Other: 2

Thanks in advance!

Re: Group Different Sources in One Query

richgalloway — Wed, 14 Jul 2021 17:57:53 GMT

The dedup command is redundant when stats is used and timechart often (but not always) is redundant to stats. Have you tried just timechart?

Re: Group Different Sources in One Query

a0491455 — Wed, 14 Jul 2021 15:53:40 GMT

This unfortunately did not work for me. The code works the same with or without the "rex" command in this case.

My assumption is that the data format (the example I posted was "/license_compliance-splunk-data/iCinga_ingest/iCingaDev_2021-07-07.csv") is not being read and grouped (because it's automated for once every 24hr) by the current query.

Re: Group Different Sources in One Query

richgalloway — Wed, 14 Jul 2021 17:58:09 GMT

Please try my edited answer.