Reporting

use partial data from a field in reports

bhartmann
New Member

Hi,

We have a version field with 4 numbers, for instance 2018.1.0.1234 (major.minor.patch.build)

One report will need the full version number, but we also want a chart which essentially throws away patch.build (leaving just values such as 2018.0, 2018.1, etc.). Of course we could send the data with a second key to get the shorter values, but I assume there are better ways so we can keep our data throughput down.

Would appreciate help with example(s) of how to achieve this.

Thanks!

0 Karma
1 Solution

adonio
Ultra Champion

hello there,

many ways to go about this one, here is a sample using the | rex command to create 4 fields as you asked above.
run this search anywhere to check:

    | makeresults count=1 
    | eval version="2018.1.0.1234,2018.2.0.1234,2018.1.2.1234,2018.1.0.1235"
    | makemv delim="," version
    | mvexpand version
    | rex field=version "(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)\.(?<build>\d+)"

from here you can go many ways, for example"
| eval major_minor = major.".".minor

hope it helps

View solution in original post

adonio
Ultra Champion

hello there,

many ways to go about this one, here is a sample using the | rex command to create 4 fields as you asked above.
run this search anywhere to check:

    | makeresults count=1 
    | eval version="2018.1.0.1234,2018.2.0.1234,2018.1.2.1234,2018.1.0.1235"
    | makemv delim="," version
    | mvexpand version
    | rex field=version "(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)\.(?<build>\d+)"

from here you can go many ways, for example"
| eval major_minor = major.".".minor

hope it helps

Get Updates on the Splunk Community!

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...