topic Re: Report using Splunk in Reporting

Report using Splunk

abhayneilam — Tue, 16 Oct 2012 19:07:24 GMT

I have a file which contains :
Name,age,location,SEARCH
abhay,24,kolkata,XXX
vidu,49,chennaii,YYY
ajay,34,mumbaii,XXX
puja,45,hydrabad,XXX
this,34,mumbai,ZZZ
sure,34,kolkata,YYY

Now, i want to output like :

XXX 3
YYY 2
ZZZ 1

means first field will have the KEYWORD list and second field will have the count

Re: Report using Splunk

Wilcooley — Tue, 16 Oct 2012 19:20:37 GMT

| inputlookup (or inputcsv) foo.csv | search SEARCH=* | eval SEARCH=lower(SEARCH) | stats count by SEARCH

Re: Report using Splunk

abhayneilam — Tue, 16 Oct 2012 19:48:01 GMT

if my SEARCH field is :

XXX
xXx
xxx
XXx
XxX
XXX

then, i want to count XXX as 6 in this case but here all are coming different count...

Re: Report using Splunk

abhayneilam — Tue, 16 Oct 2012 19:48:36 GMT

and also i would like to delete if any blank line is there

Re: Report using Splunk

Wilcooley — Tue, 16 Oct 2012 20:09:00 GMT

I've updated with these 2 additional constraints.
By "delete if any blank line" do you mean the whole line could be blank or just the "SEARCH" column? The first case should be handled automatically; the "search SEARCH=*" should work for the latter.

Re: Report using Splunk

Wilcooley — Thu, 18 Oct 2012 20:27:19 GMT

@abhayneilam: Does this answer your question? If so, could you mark it as such?