Splunk Search

How to get the result of sorting in a group?

flzhang132
Explorer

I want to get the result of sorting in the group.
alt text

0 Karma
1 Solution

adonio
Ultra Champion

maybe try this:

| makeresults count=1
| eval data = "host1,a;host1,b;host2,c;host2,d;host3,a"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<project>[^,]+)\,(?<value>\S+)"
| table project value
| rename COMMENT as "the above creates data, below is the solution"
| streamstats count as number by project

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

maybe try this:

| makeresults count=1
| eval data = "host1,a;host1,b;host2,c;host2,d;host3,a"
| makemv delim=";" data
| mvexpand data
| rex field=data "(?<project>[^,]+)\,(?<value>\S+)"
| table project value
| rename COMMENT as "the above creates data, below is the solution"
| streamstats count as number by project

hope it helps

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...