Splunk Search

Combining Rows from Case-Insensitive search with multiple results?

Communicator

When searching an index for "foo", multiple results are returned as so;

Ex. index=blah machine_domain=foo | stats count by machine_domain

foo     1
Foo     2
FOO     3

How would one combine the rows and counts?

0 Karma
1 Solution

Revered Legend

You can decide on which case to display the machine_domain (I have used upper) and then use below command.

index=blah machine_domain=foo | eval machine_domain=upper(machine_domain)| stats count by machine_domain 

View solution in original post

Revered Legend

You can decide on which case to display the machine_domain (I have used upper) and then use below command.

index=blah machine_domain=foo | eval machine_domain=upper(machine_domain)| stats count by machine_domain 

View solution in original post

Revered Legend

Yes...the answer I provided is showing all the data/count, its the just how/which case the machine_name will be displayed, you have to decide. Your can upper or lower (in eval command) for the same. So if you want final output as "foo....6", use "|eval machine_domain=lower(machine_name)".

0 Karma

Communicator

That worked, and combined the counts. Could you possibly elaborate on how this works to combine the results? It reads like all it's going to do is capitalize the initial search.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!