topic Re: Group events by specific field and generate timechart for both groups in Splunk Search

Grouping events by specific field and generate timechart for both groups?

Sanshan — Fri, 21 Jul 2023 17:26:53 GMT

There is a complicated requirement for me, the splunk beginner. Hope you can give me some advice.

The splunk version: 9.0.2303.201

Since there are a lot of logs(events) that meet my search requirement, I want to generate a time chart with those logs.

I want to group those logs by a specific field named "field1":

For events in group A, their "field1" value is unique when compared with all other events;
For events in group B, their "field1" value has been repeated once when compared with other events, which means when I search the value of "field1"(group B), it will return two events.

Based on this premise, I want to count the event that happened times of both two groups, and display them in a timeline(time chart), what can I do?

Re: Group events by specific field and generate timechart for both groups

meetmshah — Fri, 21 Jul 2023 05:01:50 GMT

Hello @Sanshan Would you be able to share example with values? Also, an image with the expected chart would be helpful to answer

Re: Group events by specific field and generate timechart for both groups

diogofgm — Fri, 21 Jul 2023 05:11:59 GMT

You can use the grouping you explained with some splunk commands to accomplish that.

| windbag | eval group = if(lang="Euro","groupA","groupB") | timechart count by group

This is just an example with random data that you can try in your environment . You can change your grouping conditions in the if statement to your field1=your unique value.

Re: Group events by specific field and generate timechart for both groups

Sanshan — Fri, 21 Jul 2023 05:40:28 GMT

Sure, the "field1" has a value of random UUID to mark a single trigger behavior.
But in some cases, it returns two times' logs with the same UUID, so I really need to separate the two situations(A: A unique UUID only appeared in one event; B: In two different events, they have the same UUID).

For the chart: