Getting Data In

Help with the logic to make this count my fields correctly

Explorer

Hi, I have the following field called OS with 6 different values and count for each value:

Windows = 5
Mac = 4
Linux = 5
Mac, Windows = 10
Mac, Windows, Linux = 12
Mac, Linux = 11

The problem stand on that the real total of Windows values would be Windows,Windows+Mac,Windows,Linux (5+10+12)

So I would like to separate Mac,Windows into Windows and Mac values and add them to the Windows and Mac value.

At the end I would like to have something like:

Windows=27
Mac=26
Linux=16

My idea is to rename them twice but it doesn't really work out for me. Any ideas or solutions are welcome.

Cheers

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Give this a try

If you have field OS only showing the OS names and not the count.

your current search giving field OS and count
| makemv OS delim=","  | mvexpand OS | stats sum(count) as count by OS

If Windows = 5 is the actual full value for field OS, try this (extracting OS names and count)

your current search giving field OS with values like Windows = 5
| rex field=OS "(?<OS1>\S+)\s*\=(?<count>\d+)"
 | makemv OS1 delim=","  | mvexpand OS1 | stats sum(count) as count by OS1 | rename OS1 as OS

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Give this a try

If you have field OS only showing the OS names and not the count.

your current search giving field OS and count
| makemv OS delim=","  | mvexpand OS | stats sum(count) as count by OS

If Windows = 5 is the actual full value for field OS, try this (extracting OS names and count)

your current search giving field OS with values like Windows = 5
| rex field=OS "(?<OS1>\S+)\s*\=(?<count>\d+)"
 | makemv OS1 delim=","  | mvexpand OS1 | stats sum(count) as count by OS1 | rename OS1 as OS

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!