Splunk Search

How to condense search outputs?

odle89
Engager

I would like to condense this search output in order to see all Windows versions as "Windows" and all Mac versions as "Mac".

sourcetype="fire-ext_prd_app" NOT cv 
| eval Mac = proctorCacheOS2
| eval Windows = proctorCacheOS
| spath output=proctorCacheOS path="msg0.OS" 
| spath output=proctorCacheOS2 path="msg0.OS" 
| search proctorCacheOS=Windows* OR proctorCacheOS2=Mac*
| top limit=50 proctorCacheOS
0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

Add the eval statement that I added above your last line of the search.

sourcetype="fire-ext_prd_app" NOT cv 
 | eval Mac = proctorCacheOS2
 | eval Windows = proctorCacheOS
 | spath output=proctorCacheOS path="msg0.OS" 
 | spath output=proctorCacheOS2 path="msg0.OS" 
 | search proctorCacheOS=Windows* OR proctorCacheOS2=Mac*
 | eval winmac=case(proctorCacheOS like "Windows%","Windows",proctorCacheOS like "Mac%","Mac")
 | top limit=50 proctorCacheOS

View solution in original post

odle89
Engager
sourcetype="fire-ext_prd_app" NOT cv 
  | spath output=proctorCacheOS path="msg0.OS" 
  | spath output=proctorCacheOS2 path="msg0.OS" 
  | eval winmac=case(proctorCacheOS like "Windows%","Windows",proctorCacheOS like "Mac%","Mac")
  | top limit=50 winmac

I had to change a couple things but that worked! Thanks much!!

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Add the eval statement that I added above your last line of the search.

sourcetype="fire-ext_prd_app" NOT cv 
 | eval Mac = proctorCacheOS2
 | eval Windows = proctorCacheOS
 | spath output=proctorCacheOS path="msg0.OS" 
 | spath output=proctorCacheOS2 path="msg0.OS" 
 | search proctorCacheOS=Windows* OR proctorCacheOS2=Mac*
 | eval winmac=case(proctorCacheOS like "Windows%","Windows",proctorCacheOS like "Mac%","Mac")
 | top limit=50 proctorCacheOS
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...