Combining field names into one new result name

[Grant007701]

Hi,

I'm trying to combine results of varying operating systems into one, for example:

Microsoft Windows Server 2008
Microsoft Windows Server 2008r2
Microsoft Windows Server 2012

All to be listed as

Windows Server

Does anyone know I may do this? I tried this but wouldn't work:

...chart count(signature) by operating-system | eval sort_field=case(operating-system=="Microsoft Windows*",Windows Server)

[manish_singh_77]

Hi,

You can also use field aliases in this case, refer the below link for more info and let me know if it works for you.

https://docs.splunk.com/Documentation/Splunk/7.1.1/Knowledge/Addaliasestofields

[martin_mueller]

Three problems with your eval:

1. operating-system would subtract system from operating - use single quotes to enclose non-standard field names.
2. =="Microsoft Windows* looks for literal equality, use match() to allow regex-based matches.
3. Windows Server should throw syntax errors, enclose strings in double quotes.

[martin_mueller]

See docs on match(), it only takes two parameters: http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/ConditionalFunctions#match.28SUBJE...

[Grant007701]

Thanks for this.

Still struggling though, I have changed to the following:

...chart count(signature) by operating-system | eval sort_field=case('operating-system'=match('operating-system',"Microsoft*","Windows Server",0))

The arguments to the 'match' function are invalid.