Splunk Search

How to combine values?

anissabnk
Path Finder

Hello 

I have a question because I'm in trouble. 

`EasyVistaGeneric` "Statut" = "En service" AND ("Identifiant réseau"="IMP*" OR "Identifiant réseau"="ECR*" OR "Identifiant réseau"="PCW*")
|dedup "Identifiant réseau" |eval entité=mvindex(split('Entité (complète)',"/"),0)
| timechart span=1y count by entité useother=f usenull=f

 

anissabnk_0-1677170410999.png

I want to combine the results of  entité : "Commune de Toulon"  + "METROPOLE TPM" +" MTPM" + "Toulon" in a same field that we can named as RESULT :

-> so I want to have : RESULT ="Commune de Toulon"  + "METROPOLE TPM" +" MTPM" + "Toulon"

 

Can you help me please ? 

 

Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Put your field name on the right hand side of the equation in single quotes

| eval RESULT ='Commune de Toulon'  + 'METROPOLE TPM' + 'MTPM' + 'Toulon'
0 Karma

anissabnk
Path Finder

Thank you for you answer 

I want also to display the other entity : fields entité

Sa, How to specify that RESULT is a specific entité.

Thank you 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What does your SPL look like at the moment?

0 Karma

anissabnk
Path Finder

@ITWhisperer , thank you for your help 

My SPL :

`EasyVistaGeneric` "Statut" = "En service" AND ("Identifiant réseau"="IMP*" OR "Identifiant réseau"="ECR*" OR "Identifiant réseau"="PCW*")
|dedup "Identifiant réseau" |eval entité=mvindex(split('Entité (complète)',"/"),0)
| timechart span=1y count by entité useother=f usenull=f

anissabnk_0-1677232746680.png

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have you tried addtotals?

0 Karma

anissabnk
Path Finder

No, how can I do please ? 

Thanks 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
`EasyVistaGeneric` "Statut" = "En service" AND ("Identifiant réseau"="IMP*" OR "Identifiant réseau"="ECR*" OR "Identifiant réseau"="PCW*")
|dedup "Identifiant réseau" |eval entité=mvindex(split('Entité (complète)',"/"),0)
| timechart span=1y count by entité useother=f usenull=f
| addtotals
0 Karma

anissabnk
Path Finder

It doesn't work. I will explain what I want to have : 

I want to combine the results :

anissabnk_0-1677246100235.png

and have a column named as "RESULT" which corresponds as new entité

 

Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval RESULT ='Commune de Toulon'  + 'METROPOLE TPM' + 'MTPM'
0 Karma

anissabnk
Path Finder

Yes I know, But how I can modify my request to have both results : entité + RESULT ( as an "entité")

`EasyVistaGeneric` "Statut" = "En service" AND ("Identifiant réseau"="IMP*" OR "Identifiant réseau"="ECR*" OR "Identifiant réseau"="PCW*")
|dedup "Identifiant réseau" |eval entité=mvindex(split('Entité (complète)',"/"),0)
| timechart span=1y count by entité useother=f usenull=f
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I am not sure what you want - using your example values as shown in your picture, please can you given an example of what you are trying to achieve e.g. column names and values.

0 Karma

anissabnk
Path Finder

Ok, I want to have for the columns multiple entité :

- I want to merge "METROPOLE TPM" colum with "MTPM" colum and "Toulon"  and "Commune de Toulon" to have only one column instead of having 4 columns. 

That's what I want to display: 

CCAS de Toulon	| Centre Communal d'Action Sociale | RESULT | Le Revest ...

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval RESULT ='Commune de Toulon'  + 'METROPOLE TPM' + 'MTPM'
| fields - 'Commune de Toulon' 'METROPOLE TPM' 'MTPM'
0 Karma

anissabnk
Path Finder

`EasyVistaGeneric` "Statut" = "En service" AND ("Identifiant réseau"="IMP*" OR "Identifiant réseau"="ECR*" OR "Identifiant réseau"="PCW*")
|dedup "Identifiant réseau" |eval entité=mvindex(split('Entité (complète)',"/"),0) | eval RESULT ='Commune de Toulon' + 'METROPOLE TPM' + 'MTPM'
| timechart span=1y count by entité useother=f usenull=f
| fields - 'Commune de Toulon' 'METROPOLE TPM' 'MTPM' |rename "count" as "Nombre"

 

It doesn't work :

anissabnk_0-1677484981521.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You put the eval in the wrong place

`EasyVistaGeneric` "Statut" = "En service" AND ("Identifiant réseau"="IMP*" OR "Identifiant réseau"="ECR*" OR "Identifiant réseau"="PCW*")
|dedup "Identifiant réseau" |eval entité=mvindex(split('Entité (complète)',"/"),0) 
| timechart span=1y count by entité useother=f usenull=f
| eval RESULT ='Commune de Toulon' + 'METROPOLE TPM' + 'MTPM'
| fields - 'Commune de Toulon' 'METROPOLE TPM' 'MTPM' |rename "count" as "Nombre"
0 Karma

anissabnk
Path Finder
0 Karma

anissabnk
Path Finder

Hello, 

To precise something, 

`EasyVistaGeneric` "Statut" = "En service" AND ("Identifiant réseau"="IMP*" OR "Identifiant réseau"="ECR*" OR "Identifiant réseau"="PCW*")
|dedup "Identifiant réseau" |eval entité=mvindex(split('Entité (complète)',"/"),0)
|table entité |dedup entité

 

For the fields entité, we have those fields : 

I want to merge the results of the fields marked with green : 

entité

MTPM
Toulon
Opera
Centre Communal d'Action Sociale
Ecoles de Toulon
Commune de Toulon
Utilisateurs externes
Metropole 2019
Le Revest
ESAD
Office Intercommunal du Tourisme
METROPOLE TOULON PROVENCE MEDITERRANEE
Prestataires DCSI
Utilisateurs externes SIG
Commune de Le Revest-les-Eaux
Ecole Supérieure d'Art et Design
METROPOLE TPM
Caisse des ecoles de TOULON
Opéra de Toulon
CCAS de Toulon
Office Intercommunal de Tourisme
Tags (1)
0 Karma
Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...