topic Re: group source types in Splunk Search

group source types

athorat — Mon, 28 Sep 2020 19:57:40 GMT

I am getting the list of sourcetype and its usage in GB.
index=_internal source=*metrics.log | eval GB=kb/(1024*1024) | search group="per_sourcetype_thruput" | timechart span=1d sum(GB) by series limit=0 | sort -sourcetype

Want to group/categorize certain source types , like those with ecsweb:prod:E1, ecsweb:prod:E2 and ecsweb:prod:E3 in Category Prod.

Tried using the following query which does not work.
index=_internal source=metrics.log | eval GB=kb/(1024*1024) | search group="per_sourcetype_thruput" | timechart span=1d sum(GB) by series limit=0 | sort +sourcetype| eval series =if(series ="ecsweb:", "PROD", series)

Re: group source types

esix_splunk — Mon, 28 Sep 2020 19:54:10 GMT

Something like this? However this sourcetype shouldnt be in _internal...

index=_internal source=metrics.log group="per_sourcetype_thruput" sourcetype=ecsweb:prod:E* | eval GB=kb/(1024*1024) | timechart span=1d sum(GB) by series limit=0 | sort +sourcetype

Re: group source types

athorat — Thu, 14 May 2015 17:10:28 GMT

Filtering by sourcetype=ecsweb:prod:E* does return any results.
So the goal is, when the first query returns the results. The source types should be categorised into buckets.
like ECSweb:PROD :to PROD
ECSweb:PERF: to PERF.

Re: group source types

mmccul — Thu, 14 May 2015 17:14:55 GMT

Run a rex to create a new field based on the sourcetype to capture the portion of the sourcetype you care about. Use that new transformed sourcetype field instead.

Re: group source types

athorat — Thu, 14 May 2015 17:22:13 GMT

I am not sure about rex because the soruce types are being captured only challenge is to bucket them by name/similar names types into specific categories.

Re: group source types

mmccul — Thu, 14 May 2015 17:28:37 GMT

That's the point. You're capturing the sourcetypes into a field. A transform to define a new field with the reduced portion allows you to clump them according to the pattern you identified into a new field. rex field=sourcetype "^[^:]+:(?<newsrctyp>.*)" would strip out the portion up to and including the first colon for you and place into the field newsrctyp, which is now grouped.

Re: group source types

athorat — Mon, 28 Sep 2020 19:54:20 GMT

Hey So the sources are coming in a field called series

so the source type here should be Series? Tried both, no luck.
rex field=sourcetype "^[^:]+:(?<newsrctyp>.*)"

Correct me if I am wrong.

Thanks,
Anil.

Re: group source types

esix_splunk — Mon, 28 Sep 2020 19:54:23 GMT

You can try this, again this shouldnt be in your _internal index...

index=_internal source=metrics.log group="per_sourcetype_thruput" | rex field=sourcetype "ecsweb:(?<newsrc>.*)" | eval GB=kb/(1024*1024) | timechart span=1d sum(GB) by newsrc | sort -newsrc

Re: group source types

athorat — Fri, 15 May 2015 00:21:41 GMT

Throws an error as it has by series and by newsrc

Didnt get you this shouldnt be in your _internal index...???

Re: group source types

esix_splunk — Fri, 15 May 2015 00:50:24 GMT

Updated search, please try.