Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How do I take specific information from Case (...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I am trying to take specific information after a eval function. How would I go about taking only the Chrome information as an output?
eval Browser = case(TridentVersion = 8,"Windows 10 IE", TridentVersion = 7,"IE 11", TridentVersion = 6, "IE 10", TridentVersion = 5, "IE 9", TridentVersion = 4, "IE 8", EdgeVersion >= 1, "Edge", FirefoxVersion >= 1, "Firefox", SafariVersion >= 1, "Safari", ChromeVersion >=1, "Chrome", 1=1, "Other")
The reasons I'm using the eval function in the first place is to get the percentages, but I want to display each statistic in a separate panel rather than a pie chart.
I used search Browser = Chrome, but it returns the string as the value instead of the number.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try something like this:
| eval Browser = case(TridentVersion = 8,"Windows 10 IE", TridentVersion = 7,"IE 11", TridentVersion = 6, "IE 10", TridentVersion = 5, "IE 9", TridentVersion = 4, "IE 8", EdgeVersion >= 1, "Edge", FirefoxVersion >= 1, "Firefox", SafariVersion >= 1, "Safari", ChromeVersion >=1, "Chrome", 1=1, "Other") | stats count by Browser | eventstats sum(count) as count1 | evla perc=round((count/count1)*100,2) | table Browser perc
Then choose single value visualization and then use the trellis layout and split by Browser.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
From this data set, if I wanted to display just the Chrome portion, how would I go about doing that?
Ans. You can use trellis option for respective panel to display them individually.
Regards,
Tejas
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Found it! I used the list command to display the y values only.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try something like this:
| eval Browser = case(TridentVersion = 8,"Windows 10 IE", TridentVersion = 7,"IE 11", TridentVersion = 6, "IE 10", TridentVersion = 5, "IE 9", TridentVersion = 4, "IE 8", EdgeVersion >= 1, "Edge", FirefoxVersion >= 1, "Firefox", SafariVersion >= 1, "Safari", ChromeVersion >=1, "Chrome", 1=1, "Other") | stats count by Browser | eventstats sum(count) as count1 | evla perc=round((count/count1)*100,2) | table Browser perc
Then choose single value visualization and then use the trellis layout and split by Browser.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That's great! That actually answers another question I had.
From this data set, if I wanted to display just the Chrome portion, how would I go about doing that?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Basically, how do I return just the total? Because when I try visualizing, it always visualizes the word instead of the number.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...
Index This | What has goals but no motivation?
Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security
