Splunk Enterprise Security

How to combine two fields values into one

yvassilyeva
Path Finder

Hi,

I have the following table:

status                                          count

CANCELLED                                5

Cancelled                                     10

RESOLVED                                    3

Resolves                                        3

 

And i would like to combine the same name field values despite the letter cases like this:

status                                         count
Cancelled                                     15

Resolved                                        6

 

Thank you in advance.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There are a couple of ways to do that.  The most common is to use a case statement to normalize the values.

| eval status=case(status="CANCELLED" OR status="Cancelled","Cancelled", status="RESOLVED" OR status="Resolved", "Resolved", 1==1, status)

Another way is to normalize by making all values have the same case.

| eval status=lower(status)

Do either of these before the stats command.

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are a couple of ways to do that.  The most common is to use a case statement to normalize the values.

| eval status=case(status="CANCELLED" OR status="Cancelled","Cancelled", status="RESOLVED" OR status="Resolved", "Resolved", 1==1, status)

Another way is to normalize by making all values have the same case.

| eval status=lower(status)

Do either of these before the stats command.

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

yvassilyeva
Path Finder

Thank you. That is perfect

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval status=substr(status,1,1).lower(substr(status,2))
0 Karma

yvassilyeva
Path Finder

Thank you for a quick response. That also worked!

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...