Getting Data In

Interactive Field Extraction

Splunk_User792
New Member

2012-06-21 23:58:57,200 [M3P3] DEBUG - LOG|2012-06-21|23:58:57|4|9|AB123C|MCL|88|1234|123456|12345|N|N|AAAA 1234567||||||||||AAAA 1234567|AAAA 1234567||5|||||||||YES|A|AA$BBB|Y|123|

I want to extract field like Auto = with values YES and NO
When I extract field from left of the timestamp of the results of the search, I get the result as below
FIELD NAME ---- COUNT
YES --------------- 2054
NO ---------------- 21

But my total result is 2320 and count of YES should be 2054 (which is correct) and count of NO should be 266 according to the count result done by searching manually from search bar.
Why do I get incorrect count of NO?
I want to create pie chart of YES and NO counts. For that, I think I must have this information correct right?
Please Help me..
Thank you very much..

Tags (1)
0 Karma
1 Solution

rturk
Builder

You may have other instances of "YES" or "NO" in other fields which could be skewing your results. The key here is making sure your field extractions are correct.

You have a pipe-delimited filed, with the 36th field being the value you're interested in. Not sure whether you're interested in the other fields, but here goes.

props.conf

[yoursourcetype]
pulldown_type = false
KV_MODE = false
SHOULD_LINEMERGE = false
REPORT-fields = yoursourcetype_fields

transforms.conf

[yoursourcetype_fields]
DELIMS = "|"
FIELDS = "header", "date", "time", "field_4", ... , "field_35", "yes_no"

Splunk Search

sourcetype=yoursourcetype | stats count by yes_no

There is no doubt a more elegant way of doing this by regular expressions, my regex-fu is weak 😛

Hope this helps!

View solution in original post

rturk
Builder

You may have other instances of "YES" or "NO" in other fields which could be skewing your results. The key here is making sure your field extractions are correct.

You have a pipe-delimited filed, with the 36th field being the value you're interested in. Not sure whether you're interested in the other fields, but here goes.

props.conf

[yoursourcetype]
pulldown_type = false
KV_MODE = false
SHOULD_LINEMERGE = false
REPORT-fields = yoursourcetype_fields

transforms.conf

[yoursourcetype_fields]
DELIMS = "|"
FIELDS = "header", "date", "time", "field_4", ... , "field_35", "yes_no"

Splunk Search

sourcetype=yoursourcetype | stats count by yes_no

There is no doubt a more elegant way of doing this by regular expressions, my regex-fu is weak 😛

Hope this helps!

Splunk_User792
New Member

WOW, THANK YOU SO MUCH!!!! V^-^V

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...