topic Combining Multivalues together inside a field in Splunk Search

Combining Multivalues together inside a field

watsm10 — Thu, 11 Oct 2012 09:51:00 GMT

I've got a field named "User" which holds the names of all the users of our service. Some users have similar names and I'd like to group them together in search outputs.

I'm creating a search to output the number of transactions by user.

source=index | chart count by User | rename count as "Transaction Count"



User      |      Transaction Count

ABC       |       100

DEF       |       300

GHI       |       400

TEST      |       5

TEST1     |       10

TEST12    |       20

TEST123   |       200

JKL       |       300

MNO       |       200

I'd like to group everything with "TEST" in the name together (they are the all the same user, but under similar userIDs), along with adding the values for each instance of "TEST" to create a new multivalue called "TEST" (see below).



User      |      Transaction Count

ABC       |       100

DEF       |       300

GHI       |       400

TEST      |       235

JKL       |       300

MNO       |       200

Can anybody help me? Thanks.

Re: Combining Multivalues together inside a field

cphair — Thu, 11 Oct 2012 13:20:50 GMT

If you don't care about keeping all the test accounts separate, I would use rex to rename them at search time. Something like this should work:



 | rex field=User mode=sed "s/(TEST).*/\1/" | chart count by User

This assumes that no legitimate user account will have the word TEST in it, so depending on your data you may have to tweak the regex a bit.

Re: Combining Multivalues together inside a field

watsm10 — Thu, 11 Oct 2012 14:07:53 GMT

Thankyou so much!! 🙂