topic Re: How to combine similar values into one table column in Splunk Search

How to combine similar values into one table column

aristidiskantas — Wed, 15 Jun 2022 08:04:07 GMT

Hello everyone,

I am having two events with different sourcetypes that have similar fields with similar values however not the same.

I have found a way to combine the fields by using coalesce, however I would like to combine the values as well in order to get a clear result

I am running this search :

index="main" category="Foo" OR sourcetype="foo" | iplocation ip_address | eval severity_level = coalesce(severity, foo_severity) | geostats count by severity_level

and I am having the following results.

| longitude | latitude | HIGH | High | MEDIUM | Medium | LOW | Low | | 143.2104 | -33.494 | 39 | 4 | 40 | 30 | 15 | 5 |

And I want to get something like:

| longitude | latitude | HIGH | MEDIUM | LOW | | 143.2104 | -33.494 | 43 | 70 | 20 |

Could you please give a hint? Thank you very much in advance.

Re: How to combine similar values into one table column

gcusello — Wed, 15 Jun 2022 08:07:20 GMT

Hi @aristidiskantas,

you have to convert all values in upper or lower case, something like this:

index="main" category="Foo" OR sourcetype="foo" | iplocation ip_address | eval severity_level = upper(coalesce(severity, foo_severity)) | geostats count by severity_level

Ciao.

Giuseppe

Re: How to combine similar values into one table column

aristidiskantas — Wed, 15 Jun 2022 08:27:24 GMT

That worked! Thank you so mush for the input Giuseppe.

Wish you the best,

Aris

Re: How to combine similar values into one table column

gcusello — Wed, 15 Jun 2022 08:29:09 GMT

Hi @aristidiskantas,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated ;-