topic Re: Merge numberous data in a field in Splunk Search

Merge numberous data in a field

PaulaCom — Wed, 13 Mar 2024 09:47:32 GMT

Good Morning

i have a field that i've called problem_detail in our Helpdesk index. it contains all the types of problems that are logged to us. i would like to only merge those that are associated with email queries together. there are about 15 different ones.

index=mmuh_helpdesk sourcetype=mmuh_helpdesk_json | dedup id | fillnull value=NULL | search "problemtype.detailDisplayName"!=*AGRESSO* | eval problem_detail='problemtype.detailDisplayName' | eval problem_detail=replace(problem_detail, "&#8226","") | eval problem_detail=replace(problem_detail, ";","|") | eval techGroupLevel = 'techGroupLevel.levelName' | eval techGroupLevel = replace(techGroupLevel, " "," ") | eval techGroupLevel = replace(techGroupLevel, " ","") | eval techGroupLevel = replace(techGroupLevel, "Level"," Level") | eval location_Name = 'location.locationName' | eval status = 'statustype.statusTypeName' | eval priority = 'prioritytype.priorityTypeName' | eval techGroupId = 'techGroupLevel.id' | eval tech_Name = 'clientTech.displayName' | stats count by problem_detail

this spl is giving me the full list of 158 problem details and from there i can see around 15 of these relate to email.

Is there away i can combine the totals from all the problem_details that contain 'email' together.

i tried eval and then coalesce but it didnt work ..:(

thank you

Re: Merge numberous data in a field

ITWhisperer — Wed, 13 Mar 2024 09:36:07 GMT

Try something like this

Re: Merge numberous data in a field

PaulaCom — Wed, 13 Mar 2024 12:33:40 GMT

thank you - this hasn't worked .. I'm still getting all 158 problem details although now renamed as problem_classification

but i think i understand that logic and will play around with it.