Splunk Search

Format Stats Column Data

dreamwork801
Path Finder

So I'm running this search string here:

index = git | rename Data.payload.head_commit.modified{} as FilesModified | rex field=Data.payload.head_commit.message max_match=10 "(?<BugID>[bB]ug.+[^@\w\w\d{4}]\d{3,6})" |rex field=BugID max_match=10 "(?<BugIDs>\d{3,6})"|eval BugIDs = ltrim(BugIDs,"0") | stats values(BugIDs) by FilesModified | rename values(BugIDs) as BugIDs | eval BugCountPerFile = mvcount(BugIDs) | search BugIDs =* | sort by -BugCountPerFile | search "FilesModified" = "*$namespace$*" | search "FilesModified" = "*$file$*"

Basically it mines GIT to get information about bugs per file, and it works great except the format of the columns comes with each BugID on a different row like this:

FilesModified    BugID's  
source/file.cs   110
                 8889
                 556
                 8521
                 5485
                 8889

And the list can get pretty long if there are over 15 bug Id's for one file.
Is there a way to list them like 4 or 5 on a row instead of just one, and seperated by commas or spaces?

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

index = git | rename Data.payload.head_commit.modified{} as FilesModified | rex field=Data.payload.head_commit.message max_match=10 "(?<BugID>[bB]ug.+[^@\w\w\d{4}]\d{3,6})" |rex field=BugID max_match=10 "(?<BugIDs>\d{3,6})"|eval BugIDs = ltrim(BugIDs,"0") | stats values(BugIDs) BugIDs by FilesModified delim="," | eval BugCountPerFile = mvcount(BugIDs) | nomv BugIDs | search BugIDs =* | sort by -BugCountPerFile | search "FilesModified" = "*$namespace$*" | search "FilesModified" = "*$file$*"

View solution in original post

somesoni2
Revered Legend

Try this

index = git | rename Data.payload.head_commit.modified{} as FilesModified | rex field=Data.payload.head_commit.message max_match=10 "(?<BugID>[bB]ug.+[^@\w\w\d{4}]\d{3,6})" |rex field=BugID max_match=10 "(?<BugIDs>\d{3,6})"|eval BugIDs = ltrim(BugIDs,"0") | stats values(BugIDs) BugIDs by FilesModified delim="," | eval BugCountPerFile = mvcount(BugIDs) | nomv BugIDs | search BugIDs =* | sort by -BugCountPerFile | search "FilesModified" = "*$namespace$*" | search "FilesModified" = "*$file$*"

dreamwork801
Path Finder

That worked! Thank you!

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...