Splunk Search

How to Group field values into similar field values?

michaeler
Communicator

I am trying to get network outage totals by domain. I have four domains: A, B, C, D. The problem is that sometimes there are outages that effect 2-3 domains that are reported as a different event and not by domain. 

| chart count(event_id) as Count by Domain

A                                           4
B                                           7
C                                           2
D                                           5
A, B                                      2
A, D                                      4
C, B                                      3
A, D, B                                 6

I want to display outages that effect each domain. So anything that includes A (A; A,B; A,D; A,D,B) will be added and the count for A will be 16. Same for the other domains.

The end result should be:
A                            16
B                            18
C                            5
D                            15

I've tried eval domain=if(domain=A OR domain="A, B" OR domain="A, D" OR domain="A, D, B", "A", domain) ....... but that only works for the first one. The combined domains aren't included in the totals for the subsequent if statements.

Labels (3)
Tags (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

you can do it like this

| makeresults
| eval _raw = "Domain Value
A     4
B     7
C     2
D     5
A,B   2
A,D   4
C,B   3
A,D,B 6"
| multikv fields Domain Value
| fields Domain Value
```Above generate test data. You should replace it by your base search```
| eval Domain = split(Domain, ",")
| mvexpand Domain
| stats sum(Value) as Value by Domain

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

you can do it like this

| makeresults
| eval _raw = "Domain Value
A     4
B     7
C     2
D     5
A,B   2
A,D   4
C,B   3
A,D,B 6"
| multikv fields Domain Value
| fields Domain Value
```Above generate test data. You should replace it by your base search```
| eval Domain = split(Domain, ",")
| mvexpand Domain
| stats sum(Value) as Value by Domain

r. Ismo 

ITWhisperer
SplunkTrust
SplunkTrust

@isoutamo 's solution works - one tweak I would make is to remove the mvexpand as it is unnecessary as stats will work over the elements of the multivalue field mentioned in the by clause.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Thanx good to remember!
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...