topic Re: Combining field names into one new result name in Splunk Search

Combining field names into one new result name

Grant007701 — Wed, 11 Jul 2018 10:03:44 GMT

Hi,

I'm trying to combine results of varying operating systems into one, for example:

Microsoft Windows Server 2008
Microsoft Windows Server 2008r2
Microsoft Windows Server 2012

All to be listed as

Windows Server

Does anyone know I may do this? I tried this but wouldn't work:

...chart count(signature) by operating-system | eval sort_field=case(operating-system=="Microsoft Windows*",Windows Server)

martin_mueller — Wed, 11 Jul 2018 10:36:26 GMT

Three problems with your eval:

operating-system would subtract system from operating - use single quotes to enclose non-standard field names.
=="Microsoft Windows* looks for literal equality, use match() to allow regex-based matches.
Windows Server should throw syntax errors, enclose strings in double quotes.

Grant007701 — Wed, 11 Jul 2018 11:15:50 GMT

Thanks for this.

Still struggling though, I have changed to the following:

...chart count(signature) by operating-system | eval sort_field=case('operating-system'=match('operating-system',"Microsoft*","Windows Server",0))

The arguments to the 'match' function are invalid.

manish_singh_77 — Wed, 11 Jul 2018 11:33:41 GMT

Hi,

You can also use field aliases in this case, refer the below link for more info and let me know if it works for you.

martin_mueller — Wed, 11 Jul 2018 12:06:13 GMT