topic Re: Multiple Values for One Tag - Only Want to Display One in Splunk Search

Multiple Values for One Tag - Only Want to Display One

alylanchester — Tue, 04 Jul 2017 14:05:56 GMT

Hi,

I've tagged my data by location, and I am now trying to run stats on it.

Problem is a location can be Manual or Automated and relate to Bank 1 or Bank 2.

The issue I have is when running a stats, I get:

Manual Bank 1
Manual Bank 2
Automated Bank 1
Automated Bank 2

Whereas all I want to look at is Manual vs. Automated banks. Is there a way of only displaying certain tags?
If I put tag::XX!= then it doesn't run the search as the field values are tagged as both.

Thanks 🙂

Re: Multiple Values for One Tag - Only Want to Display One

gcusello — Tue, 04 Jul 2017 14:48:17 GMT

Hi alylanchester,
create an eval field with your condition to use in your stats, e.g.

your_search
| eval type=if(location="Manual*", "Manual","Automatic")
| stats count by type

Bye.
Giuseppe

Re: Multiple Values for One Tag - Only Want to Display One

alylanchester — Tue, 04 Jul 2017 14:50:33 GMT

There are 9999+ locations, we have tagged them all which is why I ask, instead of doing an Eval.

Re: Multiple Values for One Tag - Only Want to Display One

woodcock — Tue, 04 Jul 2017 15:06:42 GMT

You must be very, VERY careful when counting by tags. If an event has more than 1 tag (and that is almost always the case in every splunk deployment at least some of the time), that event will be counted more than once (once for each tag value). In any case, I would do it the way that you are and then sum it up at the end by adding this to the bottom:

... | rex field=mytag "^(?<mode>\S+)"
| stats sum(count) BY mode

That being said, I would to back and redo your tags to have 2: one for mode (which is either Automatic or Manual and one for Bank which is a number).

Re: Multiple Values for One Tag - Only Want to Display One

alylanchester — Tue, 04 Jul 2017 15:10:34 GMT

Thanks! Yes, didn't know if there was a way of filtering tags out so only some remained active in the field set.

Re: Multiple Values for One Tag - Only Want to Display One

woodcock — Fri, 08 Nov 2019 15:07:37 GMT

Yes, there is, you can use mvfilter for this.