Splunk Search

How to Group field values into similar field values?

michaeler
Communicator

I am trying to get network outage totals by domain. I have four domains: A, B, C, D. The problem is that sometimes there are outages that effect 2-3 domains that are reported as a different event and not by domain. 

| chart count(event_id) as Count by Domain

A                                           4
B                                           7
C                                           2
D                                           5
A, B                                      2
A, D                                      4
C, B                                      3
A, D, B                                 6

I want to display outages that effect each domain. So anything that includes A (A; A,B; A,D; A,D,B) will be added and the count for A will be 16. Same for the other domains.

The end result should be:
A                            16
B                            18
C                            5
D                            15

I've tried eval domain=if(domain=A OR domain="A, B" OR domain="A, D" OR domain="A, D, B", "A", domain) ....... but that only works for the first one. The combined domains aren't included in the totals for the subsequent if statements.

Labels (3)
Tags (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

you can do it like this

| makeresults
| eval _raw = "Domain Value
A     4
B     7
C     2
D     5
A,B   2
A,D   4
C,B   3
A,D,B 6"
| multikv fields Domain Value
| fields Domain Value
```Above generate test data. You should replace it by your base search```
| eval Domain = split(Domain, ",")
| mvexpand Domain
| stats sum(Value) as Value by Domain

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

you can do it like this

| makeresults
| eval _raw = "Domain Value
A     4
B     7
C     2
D     5
A,B   2
A,D   4
C,B   3
A,D,B 6"
| multikv fields Domain Value
| fields Domain Value
```Above generate test data. You should replace it by your base search```
| eval Domain = split(Domain, ",")
| mvexpand Domain
| stats sum(Value) as Value by Domain

r. Ismo 

ITWhisperer
SplunkTrust
SplunkTrust

@isoutamo 's solution works - one tweak I would make is to remove the mvexpand as it is unnecessary as stats will work over the elements of the multivalue field mentioned in the by clause.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Thanx good to remember!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...