topic Re: how to combine values in Splunk Search

How to combine values?

anissabnk — Thu, 23 Feb 2023 19:40:32 GMT

Hello

I have a question because I'm in trouble.

I want to combine the results of entité : "Commune de Toulon" + "METROPOLE TPM" +" MTPM" + "Toulon" in a same field that we can named as RESULT :

-> so I want to have : RESULT ="Commune de Toulon" + "METROPOLE TPM" +" MTPM" + "Toulon"

Can you help me please ?

Thanks

Re: how to combine values

ITWhisperer — Thu, 23 Feb 2023 17:14:23 GMT

Put your field name on the right hand side of the equation in single quotes

| eval RESULT ='Commune de Toulon' + 'METROPOLE TPM' + 'MTPM' + 'Toulon'

Re: how to combine values

anissabnk — Fri, 24 Feb 2023 08:19:44 GMT

Thank you for you answer

I want also to display the other entity : fields entité

Sa, How to specify that RESULT is a specific entité.

Thank you

Re: how to combine values

ITWhisperer — Fri, 24 Feb 2023 09:50:56 GMT

What does your SPL look like at the moment?

Re: how to combine values

anissabnk — Fri, 24 Feb 2023 10:23:22 GMT

@ITWhisperer , thank you for your help

My SPL :

`EasyVistaGeneric` "Statut" = "En service" AND ("Identifiant réseau"="IMP*" OR "Identifiant réseau"="ECR*" OR "Identifiant réseau"="PCW*")
|dedup "Identifiant réseau" |eval entité=mvindex(split('Entité (complète)',"/"),0)
| timechart span=1y count by entité useother=f usenull=f

Re: how to combine values

ITWhisperer — Fri, 24 Feb 2023 10:46:30 GMT

Have you tried addtotals?

Re: how to combine values

anissabnk — Fri, 24 Feb 2023 10:51:45 GMT

No, how can I do please ?

Thanks

Re: how to combine values

ITWhisperer — Fri, 24 Feb 2023 10:52:35 GMT

Re: how to combine values

anissabnk — Fri, 24 Feb 2023 13:42:15 GMT

It doesn't work. I will explain what I want to have :

I want to combine the results :

and have a column named as "RESULT" which corresponds as new entité.

Thanks

Re: how to combine values

ITWhisperer — Fri, 24 Feb 2023 14:28:27 GMT

| eval RESULT ='Commune de Toulon' + 'METROPOLE TPM' + 'MTPM'

Re: how to combine values

anissabnk — Fri, 24 Feb 2023 14:31:08 GMT

Yes I know, But how I can modify my request to have both results : entité + RESULT ( as an "entité")

`EasyVistaGeneric` "Statut" = "En service" AND ("Identifiant réseau"="IMP*" OR "Identifiant réseau"="ECR*" OR "Identifiant réseau"="PCW*")
|dedup "Identifiant réseau" |eval entité=mvindex(split('Entité (complète)',"/"),0)
| timechart span=1y count by entité useother=f usenull=f

Re: how to combine values

ITWhisperer — Fri, 24 Feb 2023 14:36:23 GMT

I am not sure what you want - using your example values as shown in your picture, please can you given an example of what you are trying to achieve e.g. column names and values.

Re: how to combine values

anissabnk — Fri, 24 Feb 2023 16:04:14 GMT

Ok, I want to have for the columns multiple entité :

- I want to merge "METROPOLE TPM" colum with "MTPM" colum and "Toulon" and "Commune de Toulon" to have only one column instead of having 4 columns.

That's what I want to display:

CCAS de Toulon | Centre Communal d'Action Sociale | RESULT | Le Revest ...

Re: how to combine values

ITWhisperer — Fri, 24 Feb 2023 17:20:02 GMT

| eval RESULT ='Commune de Toulon' + 'METROPOLE TPM' + 'MTPM' | fields - 'Commune de Toulon' 'METROPOLE TPM' 'MTPM'

Re: how to combine values

anissabnk — Mon, 27 Feb 2023 08:03:07 GMT

`EasyVistaGeneric` "Statut" = "En service" AND ("Identifiant réseau"="IMP*" OR "Identifiant réseau"="ECR*" OR "Identifiant réseau"="PCW*")
|dedup "Identifiant réseau" |eval entité=mvindex(split('Entité (complète)',"/"),0) | eval RESULT ='Commune de Toulon' + 'METROPOLE TPM' + 'MTPM'
| timechart span=1y count by entité useother=f usenull=f
| fields - 'Commune de Toulon' 'METROPOLE TPM' 'MTPM' |rename "count" as "Nombre"

It doesn't work :

Re: how to combine values

anissabnk — Mon, 27 Feb 2023 08:57:35 GMT

@MuS @niketn

Re: how to combine values

anissabnk — Mon, 27 Feb 2023 09:06:36 GMT

Hello,

To precise something,

`EasyVistaGeneric` "Statut" = "En service" AND ("Identifiant réseau"="IMP*" OR "Identifiant réseau"="ECR*" OR "Identifiant réseau"="PCW*")
|dedup "Identifiant réseau" |eval entité=mvindex(split('Entité (complète)',"/"),0)
|table entité |dedup entité

For the fields entité, we have those fields :

I want to merge the results of the fields marked with green :

entité

MTPM

Toulon

Opera

Centre Communal d'Action Sociale

Ecoles de Toulon

Commune de Toulon

Utilisateurs externes

Metropole 2019

Le Revest

ESAD

Office Intercommunal du Tourisme

METROPOLE TOULON PROVENCE MEDITERRANEE

Prestataires DCSI

Utilisateurs externes SIG

Commune de Le Revest-les-Eaux

Ecole Supérieure d'Art et Design

METROPOLE TPM

Caisse des ecoles de TOULON

Opéra de Toulon

CCAS de Toulon

Office Intercommunal de Tourisme

Re: how to combine values

ITWhisperer — Mon, 27 Feb 2023 09:26:20 GMT

You put the eval in the wrong place

`EasyVistaGeneric` "Statut" = "En service" AND ("Identifiant réseau"="IMP*" OR "Identifiant réseau"="ECR*" OR "Identifiant réseau"="PCW*") |dedup "Identifiant réseau" |eval entité=mvindex(split('Entité (complète)',"/"),0) | timechart span=1y count by entité useother=f usenull=f | eval RESULT ='Commune de Toulon' + 'METROPOLE TPM' + 'MTPM' | fields - 'Commune de Toulon' 'METROPOLE TPM' 'MTPM' |rename "count" as "Nombre"