topic Re: Group By Replace in Splunk Search

Group By Replace

jasonhask — Thu, 16 May 2019 02:24:52 GMT

Hello,

I have several things that come in via different platforms: Android (watch, phone, tablet), iOS (Watch, Phone, Tablet), and Web. For counting purposes I just need to know the platform (for now). I was wondering if there was any way possible to group my counts by my replaces.

index =blah source=blah earliest=-16m@m latest=-1m@m 
| stats count(eval(Status=0 OR Status=1)) as Now by Platform
| replace android* with Android, *Web* with Web, ip* with iOS
| table Platform, Now

As of now my results look like:

Platform            Now
android              96
android               1
android            1306
iOS                3000
iOS                  45
iOS                   2
Web                1286
Web                 956

What I would like:

Platform            Now
Android            1403
iOS                3047
Web                2242

Thanks in advance for any help.

Re: Group By Replace

woodcock — Thu, 16 May 2019 03:26:44 GMT

Try this:

index =blah source=blah earliest=-16m@m latest=-1m@m 
| stats count(eval(Status=0 OR Status=1)) AS Now BY Platform
| replace android* with Android, *Web* with Web, ip* with iOS
| stats sum(Now) AS Now BY Platform

Re: Group By Replace

jasonhask — Thu, 16 May 2019 07:39:20 GMT

While that didn't answer my question directly it led me in the right direction, thank you!

Re: Group By Replace

woodcock — Fri, 17 May 2019 04:08:20 GMT

OK, then do click Accept on the answer to close the question.