Splunk Search

How to get the result of sorting in a group?

flzhang132
Explorer

I want to get the result of sorting in the group.
alt text

0 Karma
1 Solution

adonio
Ultra Champion

maybe try this:

| makeresults count=1
| eval data = "host1,a;host1,b;host2,c;host2,d;host3,a"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<project>[^,]+)\,(?<value>\S+)"
| table project value
| rename COMMENT as "the above creates data, below is the solution"
| streamstats count as number by project

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

maybe try this:

| makeresults count=1
| eval data = "host1,a;host1,b;host2,c;host2,d;host3,a"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<project>[^,]+)\,(?<value>\S+)"
| table project value
| rename COMMENT as "the above creates data, below is the solution"
| streamstats count as number by project

hope it helps

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...