topic Re: Splunk Query Help! in Splunk Search

Splunk Query Help!

kc_prane — Mon, 29 Jul 2024 16:03:04 GMT

I Have Service_names (A, B ,C ,D, E, F, G, H, I J, K, L , M) but want (C ,D, E, F, G, H, I J, K, L , M ) services_names renamed as "Other_Services" | Stats by services_names | table services_names time_Taken

Thanks in advance!

Re: Splunk Query Help!

gcusello — Mon, 29 Jul 2024 16:07:41 GMT

Hi @kc_prane ,

ony one question: what's time_Token?

if it's a field, please try something like this:

<your_search | eval services_names=if(services_names IN ("A", "B"), service_name, "Other_Services") | stats values(time_Token) AS time_Token BY services_names | table services_names time_Taken

otherwise, please explain what's time_Token, or apply my approach to your search.

Ciao.

Giuseppe

Re: Splunk Query Help!

kc_prane — Mon, 29 Jul 2024 16:59:59 GMT

Hi gcusello, Thanks for the reply, Iam looking to get results like below.

my base search

| rex "^[^=\n]*=(?P<ServiceName>[^,]+)" | rex "TimeMS\s\=\s(?<Trans_Time>\d+)"

Results

ServiceName	Trans_Time	Count
A	60	1111
B	40	1234
Other_Services( C , D, E, F,G,H)	25	1234567

Re: Splunk Query Help!

gcusello — Tue, 30 Jul 2024 06:02:00 GMT

Hi @kc_prane ,

you shared only a part of your search, so I cannot check it.

anyway, does it solves your requirement?

Ciao.

Giuseppe

Re: Splunk Query Help!

kc_prane — Tue, 30 Jul 2024 15:52:25 GMT

Thanks for the help! @gcusello. I fixed my rex Iam seeing results now.