Splunk Search

How do I take specific information from Case ()?

lmzheng
Explorer

Hello,

I am trying to take specific information after a eval function. How would I go about taking only the Chrome information as an output?

eval Browser = case(TridentVersion = 8,"Windows 10 IE", TridentVersion = 7,"IE 11", TridentVersion = 6, "IE 10", TridentVersion = 5, "IE 9", TridentVersion = 4, "IE 8", EdgeVersion >= 1, "Edge", FirefoxVersion >= 1, "Firefox", SafariVersion >= 1, "Safari", ChromeVersion >=1, "Chrome", 1=1, "Other")

The reasons I'm using the eval function in the first place is to get the percentages, but I want to display each statistic in a separate panel rather than a pie chart.

I used search Browser = Chrome, but it returns the string as the value instead of the number.

0 Karma
1 Solution

mayurr98
Super Champion

try something like this:

| eval Browser = case(TridentVersion = 8,"Windows 10 IE", TridentVersion = 7,"IE 11", TridentVersion = 6, "IE 10", TridentVersion = 5, "IE 9", TridentVersion = 4, "IE 8", EdgeVersion >= 1, "Edge", FirefoxVersion >= 1, "Firefox", SafariVersion >= 1, "Safari", ChromeVersion >=1, "Chrome", 1=1, "Other") | stats count by Browser | eventstats sum(count) as count1  | evla perc=round((count/count1)*100,2) | table Browser perc

Then choose single value visualization and then use the trellis layout and split by Browser.

View solution in original post

tbavarva
Path Finder

Hi,

From this data set, if I wanted to display just the Chrome portion, how would I go about doing that?
Ans. You can use trellis option for respective panel to display them individually.

Regards,
Tejas

0 Karma

lmzheng
Explorer

Found it! I used the list command to display the y values only.

0 Karma

mayurr98
Super Champion

try something like this:

| eval Browser = case(TridentVersion = 8,"Windows 10 IE", TridentVersion = 7,"IE 11", TridentVersion = 6, "IE 10", TridentVersion = 5, "IE 9", TridentVersion = 4, "IE 8", EdgeVersion >= 1, "Edge", FirefoxVersion >= 1, "Firefox", SafariVersion >= 1, "Safari", ChromeVersion >=1, "Chrome", 1=1, "Other") | stats count by Browser | eventstats sum(count) as count1  | evla perc=round((count/count1)*100,2) | table Browser perc

Then choose single value visualization and then use the trellis layout and split by Browser.

lmzheng
Explorer

That's great! That actually answers another question I had.

From this data set, if I wanted to display just the Chrome portion, how would I go about doing that?

0 Karma

lmzheng
Explorer

Basically, how do I return just the total? Because when I try visualizing, it always visualizes the word instead of the number.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner   Watch on demand us for a demo-driven ...

The Data Connection - October 2026

We all have data. Lots of it. But that’s not the problem – it’s understanding what we should we do with it, ...

Beyond the Acceleration Zone: Maximizing Your Success with Splunk Customer Experience ...

Customer success is built on tailored guidance and accessible resources. As a Splunk user, you are encouraged ...