Splunk Search

How to group by a by Title?

mogoj
Engager

Hi guys!!
I have this search:

    index=temp sourcetype=sdc cs_host="*mto.ree.*" WT_dl=0 NOT (cs_uri_stem ="*/es-es/paginas/inicio.aspx" OR cs_uri_stem =*/results.aspx* OR cs_uri_stem =*/_layouts/*  OR cs_uri_stem =*/_catalogs/* OR cs_uri_stem =/personal* ) 
    | fillnull value="Sin Título" WT_ti
    | top limit=0 WT_ti, cs_uri_stem,WT_device  
    | eval WT_ti= urldecode(WT_ti)
    | eval percent = round(percent,2) 
    | eval Escritorio= if(WT_device=="Escritorio",count,0)
    | eval iPhone= if(WT_device=="IPhone",count,0)  
    | eval iPad= if(WT_device=="IPad",count,0)  
    | eval Otros= if(WT_device=="Linux",count,0) 
    | eval WT_ti = if (WT_ti== "Mi perfil - Noticias", "Mi perfil - Novedades",WT_ti )  
    | rename WT_ti as Titulo,cs_uri_stem as URL, count as "Paginas_Vista", percent as "Porcentaje_%"
    | search Titulo=Comunidades

Attach an image of results, my problem, I need not show de Column WT_device and show the results in a single line. It's possible?
Thanks for you time!!

0 Karma
1 Solution

TISKAR
Builder

@mogoj , Can you add this please:

| stats sum(*)  as * by Titulo URL

Search compet:

 index=temp sourcetype=sdc cs_host="*mto.ree.*" WT_dl=0 NOT (cs_uri_stem ="*/es-es/paginas/inicio.aspx" OR cs_uri_stem =*/results.aspx* OR cs_uri_stem =*/_layouts/*  OR cs_uri_stem =*/_catalogs/* OR cs_uri_stem =/personal* ) 
 | fillnull value="Sin Título" WT_ti
 | top limit=0 WT_ti, cs_uri_stem,WT_device  
 | eval WT_ti= urldecode(WT_ti)
 | eval percent = round(percent,2) 
 | eval Escritorio= if(WT_device=="Escritorio",count,0)
 | eval iPhone= if(WT_device=="IPhone",count,0)  
 | eval iPad= if(WT_device=="IPad",count,0)  
 | eval Otros= if(WT_device=="Linux",count,0) 
 | eval WT_ti = if (WT_ti== "Mi perfil - Noticias", "Mi perfil - Novedades",WT_ti )  
 | rename WT_ti as Titulo,cs_uri_stem as URL, count as "Paginas_Vista", percent as "Porcentaje_%"
 | search Titulo=Comunidades
 | stats sum(*) as * by Titulo URL

View solution in original post

TISKAR
Builder

@mogoj , Can you add this please:

| stats sum(*)  as * by Titulo URL

Search compet:

 index=temp sourcetype=sdc cs_host="*mto.ree.*" WT_dl=0 NOT (cs_uri_stem ="*/es-es/paginas/inicio.aspx" OR cs_uri_stem =*/results.aspx* OR cs_uri_stem =*/_layouts/*  OR cs_uri_stem =*/_catalogs/* OR cs_uri_stem =/personal* ) 
 | fillnull value="Sin Título" WT_ti
 | top limit=0 WT_ti, cs_uri_stem,WT_device  
 | eval WT_ti= urldecode(WT_ti)
 | eval percent = round(percent,2) 
 | eval Escritorio= if(WT_device=="Escritorio",count,0)
 | eval iPhone= if(WT_device=="IPhone",count,0)  
 | eval iPad= if(WT_device=="IPad",count,0)  
 | eval Otros= if(WT_device=="Linux",count,0) 
 | eval WT_ti = if (WT_ti== "Mi perfil - Noticias", "Mi perfil - Novedades",WT_ti )  
 | rename WT_ti as Titulo,cs_uri_stem as URL, count as "Paginas_Vista", percent as "Porcentaje_%"
 | search Titulo=Comunidades
 | stats sum(*) as * by Titulo URL

mogoj
Engager

Thanks!!!!

0 Karma

FrankVl
Ultra Champion

Can you perhaps sketch the desired result (e.g. in excel or so)? I don't entirely follow what you are looking for.

0 Karma

mogoj
Engager

Hi Frank,
I have this-->
Titulo URL WT_device Paginas Vista Porcertanje Escritorio Otros Ipad iPhone
Comunidades Paginas/default.aspx Escritorio 28 8,02 28 0 0 0
Comunidades Paginas/default.aspx iPhone 2 0,57 0 0 0 2
Comunidades Paginas/default.aspx iPad 2 0,57 0 0 2 0

And i Like this-->
Titulo URL Paginas Vista Porcentaje Escritorio Otros Ipad iPhone
Comunidades Paginas/default.aspx 32 9,16 28 0 2 2

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...