Splunk Enterprise

Group Different Sources in One Query

a0491455
Observer

Hello,

 

I'm running Splunk 8.1.2 and I'm trying to group different sources of an Index to count them within one query.

The following fields are what I'm trying to group:
index: license_compliance

fields:
- prod 

- dev

- other (anything that does not end in prod or dev)

 

 

index=license_compliance OR source="/license_compliance-splunk-data/iCinga_ingest/*"
| rex field=source "\/license_compliance-splunk-data\/iCinga_ingest\/(?<log_source>\w)" 
| eval log_source="iCinga_ingest".log_source 
| stats dc(source)
| dedup source, name
| timechart span=1d count(name) by source

 

 

 The data looks like this currently:

"/license_compliance-splunk-data/iCinga_ingest/iCingaDev_2021-07-07.csv"

I would like to get something like this:

 

 

07/07:
iCinga_Prod: 5
iCinga_Dev: 0
iCinga_Other: 2

 

 

Thanks in advance!

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The dedup command is redundant when stats is used and timechart often (but not always) is redundant to stats.  Have you tried just timechart?

 

index=license_compliance OR source="/license_compliance-splunk-data/iCinga_ingest/*"
| rex field=source "\/license_compliance-splunk-data\/iCinga_ingest\/(?<log_source>\w)" 
| eval log_source="iCinga_ingest".log_source 
| timechart span=1d count(name) by log_source

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

a0491455
Observer

This unfortunately did not work for me. The code works the same with or without the "rex" command in this case.

My assumption is that the data format (the example I posted was "/license_compliance-splunk-data/iCinga_ingest/iCingaDev_2021-07-07.csv") is not being read and grouped (because it's automated for once every 24hr) by the current query.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please try my edited answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...