topic Re: Splunk Search help! in Splunk Search

Splunk Search help!

kc_prane — Tue, 30 Jul 2024 02:52:05 GMT

I Have ServiceNames (A, B ,C ,D, E, F, G, H) but want (C ,D, E, F, G, H ) ServiceNames combined results and renamed as "Other_Services"

My base search

| rex "^[^=\n]*=(?P<ServiceName>[^,]+)"
| rex "TimeMS\s\=\s(?<Trans_Time>\d+)"

Required Results

ServiceName	Trans_Time	Count
A	60	1111
B	40	1234
Other_Services( C , D, E, F,G,H)	25	1234567

Re: Splunk Search help!

KendallW — Tue, 30 Jul 2024 04:02:20 GMT

Hi @kc_prane , try this - create a new eval field (ServiceGroup) to check whether ServiceName is A or B, else assign it to "Other_Services" :

| rex "^[^=\n]*=(?P<ServiceName>[^,]+)" | rex "TimeMS\s\=\s(?<Trans_Time>\d+)" | eval ServiceGroup = case( ServiceName == "A", "A", ServiceName == "B", "B", 1==1, "Other_Services" ) | stats avg(Trans_Time) as Avg_Trans_Time, count as Count by ServiceGroup | rename ServiceGroup as ServiceName | sort ServiceName

Re: Splunk Search help!

gcusello — Tue, 30 Jul 2024 06:04:21 GMT

Hi @kc_prane ,

what's the difference with your previous question?

Anyway, the solution hinted by @KendallW is similar with my previous one.

Ciao.

Giuseppe

Re: Splunk Search help!

kc_prane — Tue, 30 Jul 2024 15:49:51 GMT

Hello, @gcusello. Thank you for your response. I had an issue with Rex. I corrected that now, and your earlier query works for me.

Re: Splunk Search help!

kc_prane — Tue, 30 Jul 2024 15:50:42 GMT

Thanks @KendalW for the help!

Re: Splunk Search help!

gcusello — Tue, 30 Jul 2024 15:50:57 GMT

Hi @kc_prane ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉