topic Re: group different source in one querry in Splunk Search

group different source in one querry

bosch_softtec — Tue, 29 Sep 2020 14:04:31 GMT

Hi all,

I'm running Splunk 6.6 and I like to group different sources of an Index to count them within one querry.
The scenario is the following:
Index: service_log
sources:
- serviceA_1.log
- serviceA_2.log
- serviceA_3.log
- serviceB_1.log
- serviceB_2.log
- serviceC_1.log
- serviceC_2.log

I have three services running and spreaded over more servers, the log content is stored in one index. Now I like to count the service user grouped by the different sources and display the values with a trellis view. With the following SPL I get the values for each source but I have no idea how I could the sources.

index=service_log | dedup service_user | stats count(service_user) as Anzahl by source

The out put is:

/data/log/SERVICE/A_1/service.log   830
/data/log/SERVICE/A_2/service.log   822
/data/log/SERVICE/A_3/service.log   823
/data/log/SERVICE/B_1/service.log   11
/data/log/SERVICE/B_2/service.log   9
/data/log/SERVICE/C_1/service.log   2
/data/log/SERVICE/C_2/service.log   1

But I like to get something like this:

SERVICE_A   2475
SERVICE_B   20
SERVICE_C   3

Thanks for your tips and answers.

Re: group different source in one querry

dineshraj9 — Mon, 15 May 2017 09:30:50 GMT

Form your query this way -

index=service_log | rex field=source "\/data\/log\/SERVICE\/(?<log_source>\w)" | eval log_source="SERVICE_".log_source | stats dc(service_user) as Anzahl by log_source

Re: group different source in one querry

niketn — Mon, 15 May 2017 10:18:44 GMT

Try the following. Once you have tested the sourcePattern, move the same to Knowledge Objects as Calculated Field.

index=service_log 
| dedup service_user 
| eval sourcePattern=case(
                                                match(source,"/data/log/SERVICE/A_"),"SourceA",
                                                match(source,"/data/log/SERVICE/B_"),"SourceB",
                                                match(source,"/data/log/SERVICE/C_"),"SourceC",
                                                true(),"Unknown"
                                                )
| stats count(service_user) as Anzahl by sourcePattern

Re: group different source in one querry

bosch_softtec — Tue, 16 May 2017 09:36:47 GMT

Hi, thank you for the two solutions, they are both working perfect.
Due to that I only could accept one answer, I prefer the first solution because it's the shorter one. The second is doing the same but it's more to write.

Re: group different source in one querry

niketn — Tue, 16 May 2017 15:40:03 GMT

@bosch_softtec.. Please go ahead and Accept 1st answer by @dineshraj9. 🙂

Re: group different source in one querry

bosch_softtec — Wed, 17 May 2017 07:39:14 GMT

I downvoted this post because prefer the first solution because it's the shorter one

Re: group different source in one querry

niketn — Wed, 17 May 2017 08:34:50 GMT

@bosch_softtec... kindly read Splunk Community guideline and downvote only if the answer provided is incorrect or wrong. As you have already verified both the answers are correct. Query may be lengthy but might perform better. As it always exists with every question that there are multiple solutions, I was just giving you one more option.
http://docs.splunk.com/Documentation/Splunkbase/splunkbase/Answers/Splunkcommunityguidelines

You should ideally upvote all the options that work or help you and Accept the one that fits exactly as per your need. I am indeed glad that one of us was able to assist you. If rex has worked for you, next step for you should be to create a Field Extraction so that the regular expression persists as a Knowledge Object and is easy to maintain. http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX