Splunk Search

Bucketing text values

sranga
Path Finder

Hi

I was wondering if there is a way to use the bucket command on fields that have text values. If not, is there a way to achieve this through other commands?

For example, if I have the following in my log file:

<time>: id=1, field1=abc, field2=blah, field3=290  
<time>: id=2, field1=def, field2=blah, field3=2  
<time>: id=3, field1=yyy, field2=blah, field3=90  
<time>: id=4, field1=def, field2=blah, field3=9980  
<time>: id=5, field1=zzz, field2=blah, field3=29023  
<time>: id=6, field1=abc, field2=blah, field3=29330  

I would like to bucket the results based on the field1 values, something similar to bucket field1 ....

Thanks for your help.

Ranga

0 Karma

lguinn2
Legend

Why are you bucketing? If you want to summarize the results in some way, you could do this, for example:

yoursearchhere |
stats count sum(field3) as totalField3 by field1

which would summarize across the entire time period. If you wanted to do it hour-by-hour, you could do something like this

yoursearchhere |
bucket _time span=1h |
stats count sum(field3) as totalField3 by field1 _time
0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can use the eval command to do this explicitly, for example:

... | eval new_field1 = substr(field1, 0, 1) + "..." | ...

This will create a new field, "new_field1" that will collapse everything past the first character.

sranga
Path Finder

Wouldn't this just create a new field with the starting alphabet of field1? How would it bucket the results?

0 Karma

sranga
Path Finder

Yes, group by values starting with alphabets.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

It's not clear to me what you mean by this. Do you mean to group, e.g., values that start with A-E, F-K, L-P, etc?

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

Could you be more specific?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...