topic Re: How to group multiple field values into one field in Splunk Search

How to group multiple field values into one field

DEAD_BEEF — Tue, 26 Mar 2019 13:21:54 GMT

I have logs where I want to count multiple values for a single field as "start" and other various values as "end". How would I go about this? I want to be able to show two rows or columns where I show the total number of start and end values.

index=foo (my_field=1 OR my_field=2 OR my_field=3 OR my_field=4 OR my_field=5 OR my_field=6)
| eval start = my_field=1 OR my_field=2 OR my_field=3
| eval end = my_field=4 OR my_field=5 OR my_field=6
| stats count by start end

Re: How to group multiple field values into one field

DEAD_BEEF — Tue, 26 Mar 2019 13:36:27 GMT

I ended up using case

index=foo (my_field=1 OR my_field=2 OR my_field=3 OR my_field=4 OR my_field=5 OR my_field=6)
| eval status=case(my_field=1 "start", my_field=2 "start", my_field=3 "start", my_field=4 "end", my_field=5 "end", my_field=6 "end")
| stats count by status

Re: How to group multiple field values into one field

somesoni2 — Tue, 26 Mar 2019 13:44:25 GMT

That would be the way to go. A minor cosmetic change (clubbing multiple conditions together, adding else/default forrest of values/conditions):

index=foo (my_field=1 OR my_field=2 OR my_field=3 OR my_field=4 OR my_field=5 OR my_field=6)
 | eval status=case(my_field=1 OR my_field=2 OR  my_field=3, "start", true(), "end")
 | stats count by status

Re: How to group multiple field values into one field

khreddy — Tue, 29 Sep 2020 23:49:17 GMT

You could use "in" function to check the static value list to the above query:

index=foo (my_field=1 OR my_field=2 OR my_field=3 OR my_field=4 OR my_field=5 OR my_field=6)
| eval status=case(in(my_field,1,2,3),"Start",in(my_field,4,5,6),"End",1==1,NULL)
| stats count by status