Splunk Search

How to condense search outputs?

odle89
Engager

I would like to condense this search output in order to see all Windows versions as "Windows" and all Mac versions as "Mac".

sourcetype="fire-ext_prd_app" NOT cv 
| eval Mac = proctorCacheOS2
| eval Windows = proctorCacheOS
| spath output=proctorCacheOS path="msg0.OS" 
| spath output=proctorCacheOS2 path="msg0.OS" 
| search proctorCacheOS=Windows* OR proctorCacheOS2=Mac*
| top limit=50 proctorCacheOS
0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

Add the eval statement that I added above your last line of the search.

sourcetype="fire-ext_prd_app" NOT cv 
 | eval Mac = proctorCacheOS2
 | eval Windows = proctorCacheOS
 | spath output=proctorCacheOS path="msg0.OS" 
 | spath output=proctorCacheOS2 path="msg0.OS" 
 | search proctorCacheOS=Windows* OR proctorCacheOS2=Mac*
 | eval winmac=case(proctorCacheOS like "Windows%","Windows",proctorCacheOS like "Mac%","Mac")
 | top limit=50 proctorCacheOS

View solution in original post

odle89
Engager
sourcetype="fire-ext_prd_app" NOT cv 
  | spath output=proctorCacheOS path="msg0.OS" 
  | spath output=proctorCacheOS2 path="msg0.OS" 
  | eval winmac=case(proctorCacheOS like "Windows%","Windows",proctorCacheOS like "Mac%","Mac")
  | top limit=50 winmac

I had to change a couple things but that worked! Thanks much!!

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Add the eval statement that I added above your last line of the search.

sourcetype="fire-ext_prd_app" NOT cv 
 | eval Mac = proctorCacheOS2
 | eval Windows = proctorCacheOS
 | spath output=proctorCacheOS path="msg0.OS" 
 | spath output=proctorCacheOS2 path="msg0.OS" 
 | search proctorCacheOS=Windows* OR proctorCacheOS2=Mac*
 | eval winmac=case(proctorCacheOS like "Windows%","Windows",proctorCacheOS like "Mac%","Mac")
 | top limit=50 proctorCacheOS
Get Updates on the Splunk Community!

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...