Splunk Search

How to Group field values into similar field values?

michaeler
Communicator

I am trying to get network outage totals by domain. I have four domains: A, B, C, D. The problem is that sometimes there are outages that effect 2-3 domains that are reported as a different event and not by domain. 

| chart count(event_id) as Count by Domain

A                                           4
B                                           7
C                                           2
D                                           5
A, B                                      2
A, D                                      4
C, B                                      3
A, D, B                                 6

I want to display outages that effect each domain. So anything that includes A (A; A,B; A,D; A,D,B) will be added and the count for A will be 16. Same for the other domains.

The end result should be:
A                            16
B                            18
C                            5
D                            15

I've tried eval domain=if(domain=A OR domain="A, B" OR domain="A, D" OR domain="A, D, B", "A", domain) ....... but that only works for the first one. The combined domains aren't included in the totals for the subsequent if statements.

Labels (3)
Tags (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

you can do it like this

| makeresults
| eval _raw = "Domain Value
A     4
B     7
C     2
D     5
A,B   2
A,D   4
C,B   3
A,D,B 6"
| multikv fields Domain Value
| fields Domain Value
```Above generate test data. You should replace it by your base search```
| eval Domain = split(Domain, ",")
| mvexpand Domain
| stats sum(Value) as Value by Domain

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

you can do it like this

| makeresults
| eval _raw = "Domain Value
A     4
B     7
C     2
D     5
A,B   2
A,D   4
C,B   3
A,D,B 6"
| multikv fields Domain Value
| fields Domain Value
```Above generate test data. You should replace it by your base search```
| eval Domain = split(Domain, ",")
| mvexpand Domain
| stats sum(Value) as Value by Domain

r. Ismo 

ITWhisperer
SplunkTrust
SplunkTrust

@isoutamo 's solution works - one tweak I would make is to remove the mvexpand as it is unnecessary as stats will work over the elements of the multivalue field mentioned in the by clause.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Thanx good to remember!
0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...