topic Combine / Add rows in the search results using a wildcard in Splunk Search

Combine / Add rows in the search results using a wildcard

veerappan — Thu, 17 Sep 2020 23:05:42 GMT

I am beginner to Splunk and could you please help me with the following scenario. I have a search that will display a pie chart of the computer count.

Now I would like to combine the search results with a wild card search

Search I use : mySearch here | stats dc(COMPUTER) by OS

Thanks in advance.

Re: Combine / Add rows in the search results using a widcard

kamlesh_vaghela — Tue, 11 Jun 2019 12:25:41 GMT

@veerappan

Can you please try this?

YOUR_SEARCH | eval OS=case(like(lower(OS),"windows%"),"Windows",like(lower(OS),"mac%"),"Mac",1=1,OS) | stats sum("Computer Count") as "Computer Count" by OS

My Sample Search:

| makeresults | eval OS="Windows 7", "Computer Count"=50 | append [| makeresults | eval OS="Windows Server", "Computer Count"=25] | append [| makeresults | eval OS="Mac x", "Computer Count"=20]  | append [| makeresults | eval OS="Mac y", "Computer Count"=25]  | append [| makeresults | eval OS="Ubuntu", "Computer Count"=30] 
| eval OS=case(like(lower(OS),"windows%"),"Windows",like(lower(OS),"mac%"),"Mac",1=1,OS) | stats sum("Computer Count") as "Computer Count" by OS

Thanks

Re: Combine / Add rows in the search results using a widcard

veerappan — Tue, 11 Jun 2019 14:11:42 GMT

@kamlesh_vaghela Thanks a lot it works 🙂