Splunk Search

Combining Rows from Case-Insensitive search with multiple results?

mcrawford44
Communicator

When searching an index for "foo", multiple results are returned as so;

Ex. index=blah machine_domain=foo | stats count by machine_domain

foo     1
Foo     2
FOO     3

How would one combine the rows and counts?

0 Karma
1 Solution

somesoni2
Revered Legend

You can decide on which case to display the machine_domain (I have used upper) and then use below command.

index=blah machine_domain=foo | eval machine_domain=upper(machine_domain)| stats count by machine_domain 

View solution in original post

somesoni2
Revered Legend

You can decide on which case to display the machine_domain (I have used upper) and then use below command.

index=blah machine_domain=foo | eval machine_domain=upper(machine_domain)| stats count by machine_domain 

somesoni2
Revered Legend

Yes...the answer I provided is showing all the data/count, its the just how/which case the machine_name will be displayed, you have to decide. Your can upper or lower (in eval command) for the same. So if you want final output as "foo....6", use "|eval machine_domain=lower(machine_name)".

0 Karma

mcrawford44
Communicator

That worked, and combined the counts. Could you possibly elaborate on how this works to combine the results? It reads like all it's going to do is capitalize the initial search.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...