https://community.splunk.com/t5/Splunk-Search/How-to-group-some-of-field-value-into-new-fields-value/m-p/620831#M215804 <P>This depends a lot on when you want this transformation. &nbsp;If you want to see transformation before stats, it will depends on data characteristics. &nbsp;Now, assuming you only want the transformation after <FONT face="andale mono,times">| stats count by category</FONT>, you can do</P><LI-CODE lang="markup">| eval newCategory = case(category IN ("Anonymizers", "Anonymizing Utilities", "Anonymizing Utilities, Internet Services"), "Anonymizers", category LIKE "Gambling%", "Gambling", category LIKE "Malicious Sites%", "Malicious Sites", true(), "Undef")</LI-CODE><P>&nbsp;</P> Tue, 15 Nov 2022 05:36:48 GMT yuanliu 2022-11-15T05:36:48Z https://community.splunk.com/t5/Splunk-Search/How-to-group-some-of-field-value-into-new-fields-value/m-p/620720#M215776 <P>Hi peeps,</P> <P>Need help to do some query. Basically I'm trying to group some of field value in the <STRONG>'Category</STRONG>' field into new fields call <STRONG>'newCategory'.&nbsp;</STRONG>Below are the sample of data:</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="syazwani_0-1668417552002.png" style="width: 578px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/22458i1DBD97BA603DC687/image-dimensions/578x238?v=v2" width="578" height="238" role="button" title="syazwani_0-1668417552002.png" alt="syazwani_0-1668417552002.png" /></span></P> <P>The <STRONG>newCategory</STRONG> field will have the new count for each of the new field value (such as Anonymizers, Gambling, Malicious Site).</P> <P>Please help.&nbsp;</P> <P>Thank you.</P> <P>&nbsp;</P> Mon, 14 Nov 2022 13:37:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-group-some-of-field-value-into-new-fields-value/m-p/620720#M215776 syazwani 2022-11-14T13:37:04Z https://community.splunk.com/t5/Splunk-Search/How-to-group-some-of-field-value-into-new-fields-value/m-p/620831#M215804 <P>This depends a lot on when you want this transformation. &nbsp;If you want to see transformation before stats, it will depends on data characteristics. &nbsp;Now, assuming you only want the transformation after <FONT face="andale mono,times">| stats count by category</FONT>, you can do</P><LI-CODE lang="markup">| eval newCategory = case(category IN ("Anonymizers", "Anonymizing Utilities", "Anonymizing Utilities, Internet Services"), "Anonymizers", category LIKE "Gambling%", "Gambling", category LIKE "Malicious Sites%", "Malicious Sites", true(), "Undef")</LI-CODE><P>&nbsp;</P> Tue, 15 Nov 2022 05:36:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-group-some-of-field-value-into-new-fields-value/m-p/620831#M215804 yuanliu 2022-11-15T05:36:48Z https://community.splunk.com/t5/Splunk-Search/How-to-group-some-of-field-value-into-new-fields-value/m-p/620847#M215810 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/33901">@yuanliu</a>&nbsp;, thanks for reply. This solution worked. I try to do&nbsp;</P> Tue, 15 Nov 2022 07:51:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-group-some-of-field-value-into-new-fields-value/m-p/620847#M215810 syazwani 2022-11-15T07:51:13Z