How can I compare values within 1 field and group them

[skyblue123]

Hi,

I'm new to Splunk and I was trying to compare values in the same field and group them subsequently.

The events had client transaction id, pp_account_number, corrid different so had to remove them and compare and group. I used | stats group by and it didn't get me the results.  There were results that looked same but were not grouped together. Below is my query. I went on to remove spaces so that it will group better but didn't work as well . 

(index=pp_cal_live_logs_failure_services OR index=pp_cal_live_logs_success_sampling OR index=pp_cal_live_logs_allowlist)(machineColo="*") source IN ("riskexternalgateway")
| eval corrId=corr_id
| fields "corrId" , "calName" , "calMessage"
| where (match(calName,"Monitor_Vendor_Service_Call") AND match(calMessage,"usecase_name=US_CIPACHFunding&VReq[a-z]*"))
| eval calMessage= replace(calMessage, " ", "")
| eval calMessage = replace(calMessage, "<client_transaction_id>.*</client_transaction_id>" ," ")
| eval calMessage = replace(calMessage, "<pp_account_number>.*</pp_account_number>" ," ")
| eval calMessage = replace(calMessage, "corr_id_=.*" ,"")
| stats by calMessage 

[skyblue123]

Hi, I have found the solution. can you help to delete my post? thank you

[gcusello]

Hi @skyblue123,

please, don't delete your post, it could be useful for other people.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello · Accepted solution]

Hi @skyblue123,

please try this:

(index=pp_cal_live_logs_failure_services OR index=pp_cal_live_logs_success_sampling OR index=pp_cal_live_logs_allowlist)(machineColo="*") source IN ("riskexternalgateway")
| rename corr_id AS corrId
| eval 
 status_calName=if(match(calName,"Monitor_Vendor_Service_Call"),"yes","not"), 
 status_calMessage=if(match(calMessage,"usecase_name=US_CIPACHFunding&VReq[a-z]*"),"yes","not")
| where status_calName="yes AND status_calMessage="yes"
| eval calMessage= replace(calMessage, " ", "")
| eval calMessage = replace(calMessage, "<client_transaction_id>.*</client_transaction_id>" ," ")
| eval calMessage = replace(calMessage, "<pp_account_number>.*</pp_account_number>" ," ")
| eval calMessage = replace(calMessage, "corr_id_=.*" ,"")
| stats by calMessage 

Ciao.

Giuseppe

[skyblue123]

tried the above. but there were still duplicates that can be grouped together but were not.

this is how a calMessage field looks like: