Getting Data In

Interactive Field Extraction

Splunk_User792
New Member

2012-06-21 23:58:57,200 [M3P3] DEBUG - LOG|2012-06-21|23:58:57|4|9|AB123C|MCL|88|1234|123456|12345|N|N|AAAA 1234567||||||||||AAAA 1234567|AAAA 1234567||5|||||||||YES|A|AA$BBB|Y|123|

I want to extract field like Auto = with values YES and NO
When I extract field from left of the timestamp of the results of the search, I get the result as below
FIELD NAME ---- COUNT
YES --------------- 2054
NO ---------------- 21

But my total result is 2320 and count of YES should be 2054 (which is correct) and count of NO should be 266 according to the count result done by searching manually from search bar.
Why do I get incorrect count of NO?
I want to create pie chart of YES and NO counts. For that, I think I must have this information correct right?
Please Help me..
Thank you very much..

Tags (1)
0 Karma
1 Solution

rturk
Builder

You may have other instances of "YES" or "NO" in other fields which could be skewing your results. The key here is making sure your field extractions are correct.

You have a pipe-delimited filed, with the 36th field being the value you're interested in. Not sure whether you're interested in the other fields, but here goes.

props.conf

[yoursourcetype]
pulldown_type = false
KV_MODE = false
SHOULD_LINEMERGE = false
REPORT-fields = yoursourcetype_fields

transforms.conf

[yoursourcetype_fields]
DELIMS = "|"
FIELDS = "header", "date", "time", "field_4", ... , "field_35", "yes_no"

Splunk Search

sourcetype=yoursourcetype | stats count by yes_no

There is no doubt a more elegant way of doing this by regular expressions, my regex-fu is weak 😛

Hope this helps!

View solution in original post

rturk
Builder

You may have other instances of "YES" or "NO" in other fields which could be skewing your results. The key here is making sure your field extractions are correct.

You have a pipe-delimited filed, with the 36th field being the value you're interested in. Not sure whether you're interested in the other fields, but here goes.

props.conf

[yoursourcetype]
pulldown_type = false
KV_MODE = false
SHOULD_LINEMERGE = false
REPORT-fields = yoursourcetype_fields

transforms.conf

[yoursourcetype_fields]
DELIMS = "|"
FIELDS = "header", "date", "time", "field_4", ... , "field_35", "yes_no"

Splunk Search

sourcetype=yoursourcetype | stats count by yes_no

There is no doubt a more elegant way of doing this by regular expressions, my regex-fu is weak 😛

Hope this helps!

Splunk_User792
New Member

WOW, THANK YOU SO MUCH!!!! V^-^V

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...