Splunk Search

How to condense search outputs?

odle89
Engager

I would like to condense this search output in order to see all Windows versions as "Windows" and all Mac versions as "Mac".

sourcetype="fire-ext_prd_app" NOT cv 
| eval Mac = proctorCacheOS2
| eval Windows = proctorCacheOS
| spath output=proctorCacheOS path="msg0.OS" 
| spath output=proctorCacheOS2 path="msg0.OS" 
| search proctorCacheOS=Windows* OR proctorCacheOS2=Mac*
| top limit=50 proctorCacheOS
0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

Add the eval statement that I added above your last line of the search.

sourcetype="fire-ext_prd_app" NOT cv 
 | eval Mac = proctorCacheOS2
 | eval Windows = proctorCacheOS
 | spath output=proctorCacheOS path="msg0.OS" 
 | spath output=proctorCacheOS2 path="msg0.OS" 
 | search proctorCacheOS=Windows* OR proctorCacheOS2=Mac*
 | eval winmac=case(proctorCacheOS like "Windows%","Windows",proctorCacheOS like "Mac%","Mac")
 | top limit=50 proctorCacheOS

View solution in original post

odle89
Engager
sourcetype="fire-ext_prd_app" NOT cv 
  | spath output=proctorCacheOS path="msg0.OS" 
  | spath output=proctorCacheOS2 path="msg0.OS" 
  | eval winmac=case(proctorCacheOS like "Windows%","Windows",proctorCacheOS like "Mac%","Mac")
  | top limit=50 winmac

I had to change a couple things but that worked! Thanks much!!

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Add the eval statement that I added above your last line of the search.

sourcetype="fire-ext_prd_app" NOT cv 
 | eval Mac = proctorCacheOS2
 | eval Windows = proctorCacheOS
 | spath output=proctorCacheOS path="msg0.OS" 
 | spath output=proctorCacheOS2 path="msg0.OS" 
 | search proctorCacheOS=Windows* OR proctorCacheOS2=Mac*
 | eval winmac=case(proctorCacheOS like "Windows%","Windows",proctorCacheOS like "Mac%","Mac")
 | top limit=50 proctorCacheOS
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...