topic Re: How do I take specific information from Case ()? in Splunk Search

How do I take specific information from Case ()?

lmzheng — Fri, 08 Nov 2019 16:06:18 GMT

Hello,

I am trying to take specific information after a eval function. How would I go about taking only the Chrome information as an output?

eval Browser = case(TridentVersion = 8,"Windows 10 IE", TridentVersion = 7,"IE 11", TridentVersion = 6, "IE 10", TridentVersion = 5, "IE 9", TridentVersion = 4, "IE 8", EdgeVersion >= 1, "Edge", FirefoxVersion >= 1, "Firefox", SafariVersion >= 1, "Safari", ChromeVersion >=1, "Chrome", 1=1, "Other")

The reasons I'm using the eval function in the first place is to get the percentages, but I want to display each statistic in a separate panel rather than a pie chart.

I used search Browser = Chrome, but it returns the string as the value instead of the number.

Re: How do I take specific information from Case ()?

mayurr98 — Fri, 08 Nov 2019 16:29:06 GMT

try something like this:

| eval Browser = case(TridentVersion = 8,"Windows 10 IE", TridentVersion = 7,"IE 11", TridentVersion = 6, "IE 10", TridentVersion = 5, "IE 9", TridentVersion = 4, "IE 8", EdgeVersion >= 1, "Edge", FirefoxVersion >= 1, "Firefox", SafariVersion >= 1, "Safari", ChromeVersion >=1, "Chrome", 1=1, "Other") | stats count by Browser | eventstats sum(count) as count1  | evla perc=round((count/count1)*100,2) | table Browser perc

Then choose single value visualization and then use the trellis layout and split by Browser.

Re: How do I take specific information from Case ()?

lmzheng — Fri, 08 Nov 2019 16:32:51 GMT

That's great! That actually answers another question I had.

From this data set, if I wanted to display just the Chrome portion, how would I go about doing that?

Re: How do I take specific information from Case ()?

lmzheng — Fri, 08 Nov 2019 16:40:54 GMT

Basically, how do I return just the total? Because when I try visualizing, it always visualizes the word instead of the number.

Re: How do I take specific information from Case ()?

lmzheng — Fri, 08 Nov 2019 16:50:50 GMT

Found it! I used the list command to display the y values only.

Re: How do I take specific information from Case ()?

tbavarva — Sun, 10 Nov 2019 14:22:33 GMT

Hi,

From this data set, if I wanted to display just the Chrome portion, how would I go about doing that?
Ans. You can use trellis option for respective panel to display them individually.

Regards,
Tejas