Deployment Architecture

How to group similar results from one field?

MikeB
Path Finder

Hello! I'm hoping some Splunk masters can help me with what I thought would have been an easy task but I'm very much stuck on it.  How can I group similar starting results into one result within the same field? I have a field that spits out results formatted like this:

index=prod_side sourcetype=prod_one  fail_code=* | table fail_code

Results:

fail_code
c-tr [213]
c-tr [893]
c-tr [309]

e-hw [gold]
e-hw [silver]
e-hw [bronze]
e-pr [vbix]
e-pr [zbix]
g-tr [345]
g-tr [123]
d-st [(intel.arm64) T 123 123]
d-st [(intel.arm64) T 456 456]

I want to group results and count the total for each by the 4 characters before the brackets [ ] begin. The content in the brackets is not relevant to me and can be done away with in the results table:

fail_code_name     value_count
c-tr                                  3
e-hw                               3
e-pr                                 2
g-tr                                  2
d-st                                 2

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There likely are several ways to do that.  I like to use rex to extract the interesting bits into a separate field and then group by that field.

index=prod_side sourcetype=prod_one  fail_code=*
| rex field=fail_code "(?<fail_code_name>[^\[]+)"
| stats count as value_count by fail_code_name
| table fail_code_name value_count
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

There likely are several ways to do that.  I like to use rex to extract the interesting bits into a separate field and then group by that field.

index=prod_side sourcetype=prod_one  fail_code=*
| rex field=fail_code "(?<fail_code_name>[^\[]+)"
| stats count as value_count by fail_code_name
| table fail_code_name value_count
---
If this reply helps you, Karma would be appreciated.

MikeB
Path Finder

This is fantastic! If I may, how would I write a regular expression to capture groups by the first two characters? Like if I just wanted:

fail_code_name     
c-                                        
d-
e-

I also have several values that are:
c-tr [1234] 
c-tr [6532]
c-ds [4567]
c-pd [8791]
d-st [6549]
d-ty [6321]
d-pr [8912]
e-hw [3691]
e-rt [8742]
e-zx [9911]

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Regex for first two characters of a string is relatively easy

^.{2}

But I suppose using ane eval with substring function would be marginally more effective (regexps as such are quite a heavy machinery)

MikeB
Path Finder

Thank you! That was good advice. For future finders of this post you would replace the following:

From: 

| rex field=fail_code "(?<fail_code_name>[^\[]+)"

 

To this: 

| rex field=fail_code "(?<fail_code_name>^.{2}+)"

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...