Splunk Search

Combine two fields values in 1 value

NewMilenium
Path Finder

Hello,
I searched for hours without any working result, sorry.
Somes searches I'm running give out results, with a field named "service" with some results, and two of those results are "HTTP" and "http". I must do something them so that they are both "HTTP", the same value.
One of the searches, for example, is of that form :

index="nnn" service="*" | stats count(service) by service | sort 10 -num(count(service))

Some of the results it can return are like that :

    service     count(service)
1   HTTP        492234
2   http        219422
3   SNMP        188368
4   DNS         152919

Can anyone help me, please? Thanks a lot for any clue!

Tags (2)
0 Karma
1 Solution

rturk
Builder

Hi NewMillenium,

Try the following:

index="nnn" service="*" 
| eval service=upper(service) 
| stats count(service) AS count BY service 
| sort -count

Let me know how you go :slightly_smiling_face:

References:

View solution in original post

rturk
Builder

Hi NewMillenium,

Try the following:

index="nnn" service="*" 
| eval service=upper(service) 
| stats count(service) AS count BY service 
| sort -count

Let me know how you go :slightly_smiling_face:

References:

rturk
Builder

Yep, that's exactly it :slightly_smiling_face: Happy Splunking!

0 Karma

NewMilenium
Path Finder

Oh, it works!
If I get it right: this is permitting to change ALL services into their uppercase writing, and so resolving my problems, and you're just having "count(service)" as "count" so you don't have to rewrite "count(service)" in the sort...?

Thanks a lot for your help!!
(one "L" only to my nickname - no offense, I say it to absolutely everybody :face_with_tongue: )

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...