topic Re: Can I create a new field for each value contained in an existing field? in Splunk Search

Can I create a new field for each value contained in an existing field?

mrfredman — Wed, 18 Feb 2015 21:42:57 GMT

Hi,

I'm a bit unsure how to go about this, but essentially I'd like to create a new field for each value contained in an existing field.

I have a field that we'll call name containing several hundred entries. I'd like to create a new value for each field in name containing the count of all entries associated with that name.

In pseudo-code, I imagine it working something like this:
stats count(eval(name=n)) as "n" creating a new n for every value contained in name.

Is this possible?

Can I loop a statement, populating n with a new value each time?

Re: Can I create a new field for each value contained in an existing field?

ramdaspr — Wed, 18 Feb 2015 23:08:25 GMT

Can you add a sample of your input data and what the output should look like so that we get a better idea what you are trying to achieve.

Re: Can I create a new field for each value contained in an existing field?

mrfredman — Wed, 18 Feb 2015 23:29:59 GMT

I can't go into too much detail, but I'll do my best.

My input contains 3 columns: id, name, and created date.

The output I'm looking for is: a row for each month of the year, with a column name, and a count of ids per name/month.

Sort of like this:

        Name Name2 Name3
Jan-14  1   0   3
Feb-14  2   4   4
Mar-14  0   0   1

(I've got all the time conversion and sorting figured out, I'm just having trouble sorting by both month and name (I can easily do one or the other but not both) so I figured if each name had a field I could just count those fields by month)

Re: Can I create a new field for each value contained in an existing field?

ramdaspr — Wed, 18 Feb 2015 23:42:53 GMT

.. | stats count(name) by date, name | transpose

Re: Can I create a new field for each value contained in an existing field?

mrfredman — Wed, 18 Feb 2015 23:48:21 GMT

While that almost works, the end goal (which I haven't yet mentioned, apologies) is to chart this data in a line graph with a line for each name.

As far as I can tell, I can't do this unless I'm able to break out each name into it's own field and ensure there is only 1 row per date.

Re: Can I create a new field for each value contained in an existing field?

Raghav2384 — Thu, 19 Feb 2015 01:37:57 GMT

chart count over Name by month?

Re: Can I create a new field for each value contained in an existing field?

ramdaspr — Thu, 19 Feb 2015 02:17:36 GMT

chart count(name) over date by name

should give a line graph with lines for names and count as Y Axis and Date as the X-axis

Re: Can I create a new field for each value contained in an existing field?

mrfredman — Thu, 19 Feb 2015 21:46:15 GMT

That did the trick. Thanks!

This creates a new problem were all but the top 11 names get lumped into an Other category, but this certainly answers my initial question.

Re: Can I create a new field for each value contained in an existing field?

ramdaspr — Thu, 19 Feb 2015 22:25:21 GMT

 chart count(name) over date by name useother=f

to force all series to be shown.