How to combine Values Within Stats Command

[whunterj]

I have written a search that breaks down the four values in the majorCustomer field and counts the number of servers in each of the four majorCustomers. What I want to do is combine the commercial and information systems customer into one called corporate and have the count be a sum of their individual server counts. Any suggestions?

This is the search:

index=citrix
| fields majorCustomer Host
| rename majorCustomer as "Line of Business"
| stats count(Host) as Servers by "Line of Business"
| eventstats sum(Servers) as Total
| eval Percentage = (Servers/Total)*100
| eval Percentage = round(Percentage, 2)
| eval Percentage = Percentage + "%"
| table "Line of Business" Servers Percentage
| sort -Servers!

alt text

[niketn]

@whunterj try the following eval after your fields pipe | eval majorCustomer=case(majorCustomer IN ("commercial","information systems"),"Corporate",true(),majorCustomer)

index=citrix majorCustomer=* Host=*
| fields majorCustomer Host
| eval majorCustomer=case(majorCustomer IN ("commercial","information systems"),"Corporate",true(),majorCustomer)
| rename majorCustomer as "Line of Business"
| stats count(Host) as Servers by "Line of Business"
| eventstats sum(Servers) as Total
| eval Percentage = (Servers/Total)*100
| eval Percentage = round(Percentage, 2)
| eval Percentage = Percentage + "%"
| table "Line of Business" Servers Percentage
| sort -Servers

PS: IN clause will work only if you are on Splunk 6.6 or higher, or else you would need to use majorCustomer=="commercial" OR majorCustomer=="information systems"

[whunterj]

This is exactly what I was trying to do. Thank you!

[woodcock]

If that's it, then click Accept to close the question.