topic I would like group result in Splunk Search

I would like group result

dieusplunk — Tue, 07 May 2013 14:21:58 GMT

I have this request :

sourcetype="accouting" fichier="*.log" | stats count by fichier

Here is the result :

fichier count
DIAEAEF*.log    7
DIAEAU97*.log   1
DIAEHAB*.log    5
DIAEHF*.log 9
DIAEPJ*.log 5
DIAEWF*.log 2
DIAEHP*.log 2

And I'd like to gather some files to have another table as follows :

paquet  count
AA  12
BB  6
CC  13

Explain :

AA = DIAEAEF*.log + DIAEHAB*.log
BB = DIAEAU97*.log + DIAEPJ*.log
CC = DIAEHF*.log + DIAEWF*.log + DIAEHP*.log

sorry for my english... thanks google translate 😉

Re: I would like group result

sideview — Mon, 28 Sep 2020 13:51:12 GMT

Sounds like you want a file-based lookup to define themapping from fichier to paquet. If you created that lookup and called it fichier_to_paquet,and gave it the lookup of:

fichier,paquet
DIAEAEF*.log,AA
DIAEAU97*.log,BB
DIAEHAB*.log,AA
DIAEHF*.log,CC
DIAEPJ*.log,BB
DIAEWF*.log,CC
DIAEHP*.log,CC

then you could have

... | lookup fichier_to_paquet | stats count by paquet

That way you don't even have the| stats count by fichier clause at all - you just use the lookup to get paquet fields on the event rows, and then use stats to group by paquet.