Splunk Search

How to combine similar values into one table column

aristidiskantas
Engager

Hello everyone, 

I am having two events with different sourcetypes that have similar fields with similar values however not the same.

I have found a way to combine the fields by using coalesce, however I would like to combine the values as well in order to get a clear result

I am running this search :

 

index="main" category="Foo" OR sourcetype="foo" 
| iplocation ip_address 
| eval severity_level = coalesce(severity, foo_severity)
| geostats count by severity_level

 


and I am having the following results. 

 

| longitude | latitude | HIGH | High | MEDIUM | Medium | LOW | Low |
|  143.2104 | -33.494  |  39  |  4   |   40   |   30   |  15 |  5  |

 

 
And I want to get something like:

 

| longitude | latitude | HIGH  | MEDIUM | LOW | 
|  143.2104 | -33.494  |  43   |   70   |  20 |

 

 
Could you please give a hint? Thank you very much in advance.

Labels (4)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @aristidiskantas,

you have to convert all values in upper or lower case, something like this:

index="main" category="Foo" OR sourcetype="foo" 
| iplocation ip_address 
| eval severity_level = upper(coalesce(severity, foo_severity))
| geostats count by severity_level

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @aristidiskantas,

you have to convert all values in upper or lower case, something like this:

index="main" category="Foo" OR sourcetype="foo" 
| iplocation ip_address 
| eval severity_level = upper(coalesce(severity, foo_severity))
| geostats count by severity_level

Ciao.

Giuseppe

aristidiskantas
Engager

That worked! Thank you so mush for the input Giuseppe. 

Wish you the best,

Aris

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aristidiskantas,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated ;-

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...