Splunk Search

How do I only return the first name listed under each Group and how do I count by Groups?

snuggas
New Member

The following query just gives me results but I also need to count by each Group.

index=Container_ship action=Decision result=*
| spath "Groups{}"
| search "Groups{}"=Sedan* OR "Groups{}"=SUV*
| dedup invoice
| timechart span=1mon count by result

 

Results show Yes or No but I also need to count by the Groups which has more than Sedan or SUV listed like color but I also only want to count whatever name appears first in the group entry.

 

Thanks!

Labels (1)
0 Karma

tscroggins
Influencer

@snuggas 

To split by more than one field over _time, use bin and stats instead of timechart:

| timechart span=1mon count by result

=>

| bin _time span=1m
| stats count by _time result "Groups{}"

This will generate results with _time, result, Groups{}, and count fields.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Splunk Observability Synthetic Monitoring - Resolved Incident on Detector Alerts

We’ve discovered a bug that affected the auto-clear of Synthetic Detectors in the Splunk Synthetic Monitoring ...

Video | Tom’s Smartness Journey Continues

Remember Splunk Community member Tom Kopchak? If you caught the first episode of our Smartness interview ...