Splunk Search

group different source in one querry

bosch_softtec
Path Finder

Hi all,

I'm running Splunk 6.6 and I like to group different sources of an Index to count them within one querry.
The scenario is the following:
Index: service_log
sources:
- serviceA_1.log
- serviceA_2.log
- serviceA_3.log
- serviceB_1.log
- serviceB_2.log
- serviceC_1.log
- serviceC_2.log

I have three services running and spreaded over more servers, the log content is stored in one index. Now I like to count the service user grouped by the different sources and display the values with a trellis view. With the following SPL I get the values for each source but I have no idea how I could the sources.

index=service_log | dedup service_user | stats count(service_user) as Anzahl by source

The out put is:

/data/log/SERVICE/A_1/service.log   830
/data/log/SERVICE/A_2/service.log   822
/data/log/SERVICE/A_3/service.log   823
/data/log/SERVICE/B_1/service.log   11
/data/log/SERVICE/B_2/service.log   9
/data/log/SERVICE/C_1/service.log   2
/data/log/SERVICE/C_2/service.log   1

But I like to get something like this:

SERVICE_A   2475
SERVICE_B   20
SERVICE_C   3

Thanks for your tips and answers.

Tags (1)
0 Karma
1 Solution

dineshraj9
Builder

Form your query this way -

index=service_log | rex field=source "\/data\/log\/SERVICE\/(?<log_source>\w)" | eval log_source="SERVICE_".log_source | stats dc(service_user) as Anzahl by log_source

View solution in original post

bosch_softtec
Path Finder

Hi, thank you for the two solutions, they are both working perfect.
Due to that I only could accept one answer, I prefer the first solution because it's the shorter one. The second is doing the same but it's more to write.

0 Karma

niketn
Legend

@bosch_softtec.. Please go ahead and Accept 1st answer by @dineshraj9. 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

Try the following. Once you have tested the sourcePattern, move the same to Knowledge Objects as Calculated Field.

index=service_log 
| dedup service_user 
| eval sourcePattern=case(
                                                match(source,"/data/log/SERVICE/A_"),"SourceA",
                                                match(source,"/data/log/SERVICE/B_"),"SourceB",
                                                match(source,"/data/log/SERVICE/C_"),"SourceC",
                                                true(),"Unknown"
                                                )
| stats count(service_user) as Anzahl by sourcePattern
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

bosch_softtec
Path Finder

I downvoted this post because prefer the first solution because it's the shorter one

0 Karma

niketn
Legend

@bosch_softtec... kindly read Splunk Community guideline and downvote only if the answer provided is incorrect or wrong. As you have already verified both the answers are correct. Query may be lengthy but might perform better. As it always exists with every question that there are multiple solutions, I was just giving you one more option.
http://docs.splunk.com/Documentation/Splunkbase/splunkbase/Answers/Splunkcommunityguidelines

You should ideally upvote all the options that work or help you and Accept the one that fits exactly as per your need. I am indeed glad that one of us was able to assist you. If rex has worked for you, next step for you should be to create a Field Extraction so that the regular expression persists as a Knowledge Object and is easy to maintain. http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

dineshraj9
Builder

Form your query this way -

index=service_log | rex field=source "\/data\/log\/SERVICE\/(?<log_source>\w)" | eval log_source="SERVICE_".log_source | stats dc(service_user) as Anzahl by log_source
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...