Splunk Search

How to group by a by Title?

mogoj
Engager

Hi guys!!
I have this search:

    index=temp sourcetype=sdc cs_host="*mto.ree.*" WT_dl=0 NOT (cs_uri_stem ="*/es-es/paginas/inicio.aspx" OR cs_uri_stem =*/results.aspx* OR cs_uri_stem =*/_layouts/*  OR cs_uri_stem =*/_catalogs/* OR cs_uri_stem =/personal* ) 
    | fillnull value="Sin Título" WT_ti
    | top limit=0 WT_ti, cs_uri_stem,WT_device  
    | eval WT_ti= urldecode(WT_ti)
    | eval percent = round(percent,2) 
    | eval Escritorio= if(WT_device=="Escritorio",count,0)
    | eval iPhone= if(WT_device=="IPhone",count,0)  
    | eval iPad= if(WT_device=="IPad",count,0)  
    | eval Otros= if(WT_device=="Linux",count,0) 
    | eval WT_ti = if (WT_ti== "Mi perfil - Noticias", "Mi perfil - Novedades",WT_ti )  
    | rename WT_ti as Titulo,cs_uri_stem as URL, count as "Paginas_Vista", percent as "Porcentaje_%"
    | search Titulo=Comunidades

Attach an image of results, my problem, I need not show de Column WT_device and show the results in a single line. It's possible?
Thanks for you time!!

0 Karma
1 Solution

TISKAR
Builder

@mogoj , Can you add this please:

| stats sum(*)  as * by Titulo URL

Search compet:

 index=temp sourcetype=sdc cs_host="*mto.ree.*" WT_dl=0 NOT (cs_uri_stem ="*/es-es/paginas/inicio.aspx" OR cs_uri_stem =*/results.aspx* OR cs_uri_stem =*/_layouts/*  OR cs_uri_stem =*/_catalogs/* OR cs_uri_stem =/personal* ) 
 | fillnull value="Sin Título" WT_ti
 | top limit=0 WT_ti, cs_uri_stem,WT_device  
 | eval WT_ti= urldecode(WT_ti)
 | eval percent = round(percent,2) 
 | eval Escritorio= if(WT_device=="Escritorio",count,0)
 | eval iPhone= if(WT_device=="IPhone",count,0)  
 | eval iPad= if(WT_device=="IPad",count,0)  
 | eval Otros= if(WT_device=="Linux",count,0) 
 | eval WT_ti = if (WT_ti== "Mi perfil - Noticias", "Mi perfil - Novedades",WT_ti )  
 | rename WT_ti as Titulo,cs_uri_stem as URL, count as "Paginas_Vista", percent as "Porcentaje_%"
 | search Titulo=Comunidades
 | stats sum(*) as * by Titulo URL

View solution in original post

TISKAR
Builder

@mogoj , Can you add this please:

| stats sum(*)  as * by Titulo URL

Search compet:

 index=temp sourcetype=sdc cs_host="*mto.ree.*" WT_dl=0 NOT (cs_uri_stem ="*/es-es/paginas/inicio.aspx" OR cs_uri_stem =*/results.aspx* OR cs_uri_stem =*/_layouts/*  OR cs_uri_stem =*/_catalogs/* OR cs_uri_stem =/personal* ) 
 | fillnull value="Sin Título" WT_ti
 | top limit=0 WT_ti, cs_uri_stem,WT_device  
 | eval WT_ti= urldecode(WT_ti)
 | eval percent = round(percent,2) 
 | eval Escritorio= if(WT_device=="Escritorio",count,0)
 | eval iPhone= if(WT_device=="IPhone",count,0)  
 | eval iPad= if(WT_device=="IPad",count,0)  
 | eval Otros= if(WT_device=="Linux",count,0) 
 | eval WT_ti = if (WT_ti== "Mi perfil - Noticias", "Mi perfil - Novedades",WT_ti )  
 | rename WT_ti as Titulo,cs_uri_stem as URL, count as "Paginas_Vista", percent as "Porcentaje_%"
 | search Titulo=Comunidades
 | stats sum(*) as * by Titulo URL

mogoj
Engager

Thanks!!!!

0 Karma

FrankVl
Ultra Champion

Can you perhaps sketch the desired result (e.g. in excel or so)? I don't entirely follow what you are looking for.

0 Karma

mogoj
Engager

Hi Frank,
I have this-->
Titulo URL WT_device Paginas Vista Porcertanje Escritorio Otros Ipad iPhone
Comunidades Paginas/default.aspx Escritorio 28 8,02 28 0 0 0
Comunidades Paginas/default.aspx iPhone 2 0,57 0 0 0 2
Comunidades Paginas/default.aspx iPad 2 0,57 0 0 2 0

And i Like this-->
Titulo URL Paginas Vista Porcentaje Escritorio Otros Ipad iPhone
Comunidades Paginas/default.aspx 32 9,16 28 0 2 2

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...