Splunk Search

Group By Replace

jasonhask
Explorer

Hello,

I have several things that come in via different platforms: Android (watch, phone, tablet), iOS (Watch, Phone, Tablet), and Web. For counting purposes I just need to know the platform (for now). I was wondering if there was any way possible to group my counts by my replaces.

index =blah source=blah earliest=-16m@m latest=-1m@m 
| stats count(eval(Status=0 OR Status=1)) as Now by Platform
| replace android* with Android, *Web* with Web, ip* with iOS
| table Platform, Now

As of now my results look like:

Platform            Now
android              96
android               1
android            1306
iOS                3000
iOS                  45
iOS                   2
Web                1286
Web                 956

What I would like:

Platform            Now
Android            1403
iOS                3047
Web                2242

Thanks in advance for any help.

0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

index =blah source=blah earliest=-16m@m latest=-1m@m 
| stats count(eval(Status=0 OR Status=1)) AS Now BY Platform
| replace android* with Android, *Web* with Web, ip* with iOS
| stats sum(Now) AS Now BY Platform

View solution in original post

woodcock
Esteemed Legend

Try this:

index =blah source=blah earliest=-16m@m latest=-1m@m 
| stats count(eval(Status=0 OR Status=1)) AS Now BY Platform
| replace android* with Android, *Web* with Web, ip* with iOS
| stats sum(Now) AS Now BY Platform

jasonhask
Explorer

While that didn't answer my question directly it led me in the right direction, thank you!

0 Karma

woodcock
Esteemed Legend

OK, then do click Accept on the answer to close the question.

0 Karma
Get Updates on the Splunk Community!

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...

Announcing Our Splunk MVPs

We are excited to announce the first cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...