topic Re: Using regex with timechart in Splunk Search

Using regex with timechart

sarahw3 — Wed, 02 Aug 2017 13:12:17 GMT

I want to create a timechart based on 5 tags. I have tried | timechart count by tag |regex tag="Working|No_Images|Other|Never_Checked|Camera_Not_Working" and it does not work. If I get rid of the regex, it generates the timechart but it has all the tags (70+) in the chart when I only want 5. Is there another way I can make the timechart just show the 5 tags?

Re: Using regex with timechart

gcusello — Wed, 02 Aug 2017 13:36:33 GMT

Hi sarahw3,
probably your events have more than one tag for each, you could use eval to choose only the needed five, the problem is that if an event has more than one of the five tags, it takes only the first.
try something like this

your_search
| eval event=case(tag="tag1","tag1",tag="tag2","tag2",tag="tag3","tag3",tag="tag4","tag4",tag="tag5","tag5")
| search tag=tag1 OR tag=tag2 OR tag=tag3 OR tag=tag4 OR tag=tag5
| timechart count by tag

Bye.
Giuseppe

Re: Using regex with timechart

3no — Wed, 02 Aug 2017 13:40:56 GMT

The easy way, will be to filter on the tags before the timechart (this will also be more efficient) :

index=foo (tag=Working OR tag=No_Images OR tag=Other OR tag=Never_Checked OR tag=Camera_Not_Working) | timechart count by tag

Re: Using regex with timechart

sarahw3 — Wed, 02 Aug 2017 13:48:38 GMT

Thank you so much!! That worked perfectly!