topic Re: eval case condition in Splunk Search

eval case condition

AdixitSplunk — Mon, 02 Jan 2017 12:39:38 GMT

HI ,
I have this query where i want my data in a specific format .
Here under each POD there are some 3-4 hosts ,whose total event count is 5 ...(highlighted)
Base query|stats count by host|addcoltotals

Similarly for POD 2 i have some different set of hosts whose counts is 10

Expected output:

Message POD1 POD2 Total
XYZ ........ 5.............10.......... 15

I used below query:
index="River" sourcetype=river_logs host="XYZ" OR "host="ABC" OR host="LM" OR "host="NOP" Message="*" |eval host=upper(host)|eval env=case( host=="XYZ" OR "host="ABC","POD1",host=="LM" OR "host=="NOP","POD2",1==1,"NOT MATCHED")|stats count by host env | chart values(count) over host by env

Which is giving result as :
host POD1....POD2
XYZ 2
LM ...............5
ABC 3

NOP ............5

WHICH IS NO THE expected format of result .(". "are nothing but the spaces to show how exactly result is popping)
Please help me with this one

Re: eval case condition

niketn — Mon, 02 Jan 2017 14:48:35 GMT

Is your expected output is host being first column or Message being first column?

I am not sure why have you used two statistics i.e. stats and chart when you are trying to just perform count.

Following should give you the results you are expecting.

<your base search>
| chart count by host env
| addtotals row=t col=f

PS:
1) If you want to reverse Column/Row split just reverse the by sequence i.e. chart count by env host
2) If you want to show column totals also then use change from col=f to col=t labelfield=host

Re: eval case condition

AdixitSplunk — Tue, 03 Jan 2017 08:46:19 GMT

Thank you it helped a lot .

Re: eval case condition

AdixitSplunk — Tue, 03 Jan 2017 09:01:57 GMT

I have just used .....chart count by env |addcolstotals |fillnull value="Total" env
Its actually giving result as:

env Count
POD1 5
POD2 2
POD3 3
Total 10
I want it to be like
POD1 POD2 POD3 Total
5 2 3 10
I used transpose command but its giving result like:
column row1 row2 row 3
env POD1 POD2 POD3
Count 5 2 3

Is it possible to make "POD1" POD2 as table header instead of row 1, row 2 etc.
Please help me with this .