topic How to chart over multiple fields? in Splunk Search

How to chart over multiple fields?

mahesh27 — Tue, 25 Jul 2023 18:37:47 GMT

my query:

i want output as shown below: HOW TO GET THIS??

application1	count	application2	count
L1	10	L1	15
M2	20	M2	4
L3	45	L3	100

Re: chart over multiple fields

gcusello — Tue, 25 Jul 2023 18:01:51 GMT

Hi @mahesh27 ,

have application1 and application2 the same values? and you want the count of each value in application1 and application2?

if yes, you could try something like this:

index=abd ("start app" AND "app listed") OR (("POST /ui/logs" OR "POST /ui/data" OR "POST /ui/vi/reg") "state: complete") | rex field=_raw "APP:\s+(<application>\S+)" | rex field=_raw "LLA:\s+\[?<dip>[^\]]+)." | eval app=if(searchmatch("state: complete"),"application2","application1" | chart count(eval(app="application1")) AS application1 count(eval(app="application2")) AS application2 BY application

Ciao.

Giuseppe

Re: chart over multiple fields

mahesh27 — Tue, 25 Jul 2023 18:17:38 GMT

@gcusello , application 1 and application 2 has same application names but different counts, so i want to get the application names and count separately for each application.

i tried the query which you provided i am not getting any results.

Re: chart over multiple fields

yuanliu — Tue, 25 Jul 2023 23:28:19 GMT

Have you accounted for some syntax errors? A valid search would look like

index=abd ( ("start app" AND "app listed") OR ("POST /ui/logs" OR "POST /ui/data" OR "POST /ui/vi/reg") AND "state: complete") | rex field=_raw "APP:\s+(?<application>\S+)" | rex field=_raw "LLA:\s+\[(?<dip>[^\]]+)." | dedup dip | eval app=if(searchmatch("state: complete"),"application2","application1") | chart count(eval(app="application1")) AS application1 count(eval(app="application2")) AS application2 BY application

If there is no output, it simply means that | rex field=_raw "APP:\s+(?<application>\S+)" (which @gcusello copied from your sample code) extracts nothing. You need to examine your raw data and find out what is the correct regex. Alternatively, you will need to post data samples to get help on regex.

Re: chart over multiple fields

gcusello — Wed, 26 Jul 2023 15:40:09 GMT

Hi @mahesh27

with my solution, you have a different count for application1 and application2.

the issue should be on the regexes, could you share some samples from application1 and application2?

Ciao.

Giuseppe