topic Reduce a result set using the foreach splunk search command in Splunk Search

Reduce a result set using the foreach splunk search command

lpolo — Mon, 16 Jun 2014 18:49:08 GMT

The result of a splunk query is the following:

Result set 1:

method  success failures    Over_method1    Over_method2    Over_method3
method1 0   73               3                 0            0
method2 196 0                0                 2            0

I need to reduce this result set as follow:

method  success failures    Over
method1    0    73            3
method2   196   0             2

I tried using the search command foreach but no success.

Splunk search to get result set 1|
foreach Over_* [eval Over=Over+<<FIELD>>]|
table method success failures Over

Splunk to get result set 1|
foreach Over_* [eval Over=Over+'<<FIELD>>']|
table method success failures Over

This could be done with the following query:

Splunk search to get result set 1|
=if(Over_method1>0,Over_method1,if(Over_method2>0,Over_method2,0))|
table method success failures Over

However, A simpler way is to use the foreach function. To make it work the mapping variable needs to be initialized as presented in below answer. If not the result set will not be reduced correctly. So the final query is:

Splunk to get result set 1|eval Over=0|
foreach Over_* [eval Over=Over+'<<FIELD>>']|
table method success failures Over

Thanks,
Lp

Re: Reduce a result set using the foreach splunk search command

somesoni2 — Mon, 16 Jun 2014 20:01:37 GMT

Try this

Splunk search to get result set 1| eval Over=0 | foreach Over_* [eval Over=Over + <<FIELD>>]|table method success failures Over

Alternative (using untable)

Splunk search to get result set 1 | untable method key value  | eval key=case(like(key,"Over%"),"Over",1=1,key) | chart sum(value) over method by key

Re: Reduce a result set using the foreach splunk search command

lpolo — Tue, 17 Jun 2014 11:29:05 GMT

Thanks. I made a little change for the eval expression to work, <> needs to be surrounded by single quotes. I updated the original question.

|Splunk search to get result set 1|eval Over=0 | foreach Over_* [eval Over=Over+'<>']|table method success failures Over

Re: Reduce a result set using the foreach splunk search command

lpolo — Tue, 17 Jun 2014 11:32:04 GMT

However, After reading the answer presented bellow I made a little change for the eval expression to work, <> needs to be surrounded by single quotes.