Group Different Sources in One Query

[a0491455]

Hello,

I'm running Splunk 8.1.2 and I'm trying to group different sources of an Index to count them within one query.

The following fields are what I'm trying to group:
index: license_compliance

fields:
- prod 

- dev

- other (anything that does not end in prod or dev)

index=license_compliance OR source="/license_compliance-splunk-data/iCinga_ingest/*"
| rex field=source "\/license_compliance-splunk-data\/iCinga_ingest\/(?<log_source>\w)" 
| eval log_source="iCinga_ingest".log_source 
| stats dc(source)
| dedup source, name
| timechart span=1d count(name) by source

 The data looks like this currently:

"/license_compliance-splunk-data/iCinga_ingest/iCingaDev_2021-07-07.csv"

I would like to get something like this:

07/07:
iCinga_Prod: 5
iCinga_Dev: 0
iCinga_Other: 2

Thanks in advance!

[richgalloway]

The dedup command is redundant when stats is used and timechart often (but not always) is redundant to stats.  Have you tried just timechart?

index=license_compliance OR source="/license_compliance-splunk-data/iCinga_ingest/*"
| rex field=source "\/license_compliance-splunk-data\/iCinga_ingest\/(?<log_source>\w)" 
| eval log_source="iCinga_ingest".log_source 
| timechart span=1d count(name) by log_source

[a0491455]

This unfortunately did not work for me. The code works the same with or without the "rex" command in this case.

My assumption is that the data format (the example I posted was "/license_compliance-splunk-data/iCinga_ingest/iCingaDev_2021-07-07.csv") is not being read and grouped (because it's automated for once every 24hr) by the current query.

[richgalloway]

Please try my edited answer.