Splunk Search

How to combine Values Within Stats Command

whunterj
Explorer

I have written a search that breaks down the four values in the majorCustomer field and counts the number of servers in each of the four majorCustomers. What I want to do is combine the commercial and information systems customer into one called corporate and have the count be a sum of their individual server counts. Any suggestions?

This is the search:

index=citrix
| fields majorCustomer Host
| rename majorCustomer as "Line of Business"
| stats count(Host) as Servers by "Line of Business"
| eventstats sum(Servers) as Total
| eval Percentage = (Servers/Total)*100
| eval Percentage = round(Percentage, 2)
| eval Percentage = Percentage + "%"
| table "Line of Business" Servers Percentage
| sort -Servers!

alt text

0 Karma

niketn
Legend

@whunterj try the following eval after your fields pipe | eval majorCustomer=case(majorCustomer IN ("commercial","information systems"),"Corporate",true(),majorCustomer)

index=citrix majorCustomer=* Host=*
| fields majorCustomer Host
| eval majorCustomer=case(majorCustomer IN ("commercial","information systems"),"Corporate",true(),majorCustomer)
| rename majorCustomer as "Line of Business"
| stats count(Host) as Servers by "Line of Business"
| eventstats sum(Servers) as Total
| eval Percentage = (Servers/Total)*100
| eval Percentage = round(Percentage, 2)
| eval Percentage = Percentage + "%"
| table "Line of Business" Servers Percentage
| sort -Servers

PS: IN clause will work only if you are on Splunk 6.6 or higher, or else you would need to use majorCustomer=="commercial" OR majorCustomer=="information systems"

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

whunterj
Explorer

This is exactly what I was trying to do. Thank you!

woodcock
Esteemed Legend

If that's it, then click Accept to close the question.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...