topic Re: How to group search results? in Splunk Search

How to group search results?

Petri-X — Fri, 28 Aug 2020 08:29:40 GMT

Hi all,

I searching web server's centralized logs and getting results from multiple servers. But those servers belongs to different deployments. For example:

- srv1, srv7, srv9, ... belongs to deployment Fin

- srv15, srv19, srv21, ... belongs to deployment Jpn

- srv100, srv 102, srv110, ... belongs to deployment Bra

On the results I can see the hosts, but I'm looking possibilities to group the servers into own deployments. Is that something I could do during the search by giving an array where servers are listed, or some other way? Or is this something I should do earlier?

Re: How to group search results?

ITWhisperer — Fri, 28 Aug 2020 08:51:10 GMT

... | eval deployment=case(in(server,"srv1","srv7","srv9"),"Fin",in(server,"srv15","srv19","srv21"),"Jpn",in(server,"srv100","srv102","srv110"),"Bra")

Re: How to group search results?

rnowitzki — Fri, 28 Aug 2020 08:56:27 GMT

Hi @Petri-X,

2 of many options:

1.) Create a Lookup table with 2 columns: host, deployment.
In your SPL you would then add this to add the deployment:

| lookup host_deployment.csv host OUTPUT deployment

2.) You could use case, I guess makes only sense if the list is rather small...

| eval deployment=case(host="srv1", "Fin", host="srv15", "Jpn")

The case option could be even made a bit smarter, if you extract the number of the server, and then work with ranges....but in general I would work with the 1.) option .

BR
Ralph
--
Karma and/or Solution tagging appreciated.

Re: How to group search results?

Petri-X — Fri, 28 Aug 2020 09:08:52 GMT

Ooh !! This was super quick !!

Huge thanks @rnowitzki and @ITWhisperer for your help !

I believe I'll use the case option !

Re: How to group search results?

isoutamo — Fri, 28 Aug 2020 13:36:18 GMT

And another option is to use tags for those deployments. Just add tag as wanted deployment per server.

r. Ismo

https://www.splunk.com/view/SP-CAAAGYJ

https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/Abouttagsandaliases