Splunk Search

Combine / Add rows in the search results using a wildcard

veerappan
New Member

I am beginner to Splunk and could you please help me with the following scenario. I have a search that will display a pie chart of the computer count.

Now I would like to combine the search results with a wild card search

Search I use : mySearch here | stats dc(COMPUTER) by OS

alt text

Thanks in advance.

Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@veerappan

Can you please try this?

YOUR_SEARCH | eval OS=case(like(lower(OS),"windows%"),"Windows",like(lower(OS),"mac%"),"Mac",1=1,OS) | stats sum("Computer Count") as "Computer Count" by OS

My Sample Search:

| makeresults | eval OS="Windows 7", "Computer Count"=50 | append [| makeresults | eval OS="Windows Server", "Computer Count"=25] | append [| makeresults | eval OS="Mac x", "Computer Count"=20]  | append [| makeresults | eval OS="Mac y", "Computer Count"=25]  | append [| makeresults | eval OS="Ubuntu", "Computer Count"=30] 
| eval OS=case(like(lower(OS),"windows%"),"Windows",like(lower(OS),"mac%"),"Mac",1=1,OS) | stats sum("Computer Count") as "Computer Count" by OS

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@veerappan

Can you please try this?

YOUR_SEARCH | eval OS=case(like(lower(OS),"windows%"),"Windows",like(lower(OS),"mac%"),"Mac",1=1,OS) | stats sum("Computer Count") as "Computer Count" by OS

My Sample Search:

| makeresults | eval OS="Windows 7", "Computer Count"=50 | append [| makeresults | eval OS="Windows Server", "Computer Count"=25] | append [| makeresults | eval OS="Mac x", "Computer Count"=20]  | append [| makeresults | eval OS="Mac y", "Computer Count"=25]  | append [| makeresults | eval OS="Ubuntu", "Computer Count"=30] 
| eval OS=case(like(lower(OS),"windows%"),"Windows",like(lower(OS),"mac%"),"Mac",1=1,OS) | stats sum("Computer Count") as "Computer Count" by OS

Thanks

View solution in original post

0 Karma

veerappan
New Member

@kamlesh_vaghela Thanks a lot it works 🙂

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.