Splunk Search

How to group by a by Title?

mogoj
Engager

Hi guys!!
I have this search:

    index=temp sourcetype=sdc cs_host="*mto.ree.*" WT_dl=0 NOT (cs_uri_stem ="*/es-es/paginas/inicio.aspx" OR cs_uri_stem =*/results.aspx* OR cs_uri_stem =*/_layouts/*  OR cs_uri_stem =*/_catalogs/* OR cs_uri_stem =/personal* ) 
    | fillnull value="Sin Título" WT_ti
    | top limit=0 WT_ti, cs_uri_stem,WT_device  
    | eval WT_ti= urldecode(WT_ti)
    | eval percent = round(percent,2) 
    | eval Escritorio= if(WT_device=="Escritorio",count,0)
    | eval iPhone= if(WT_device=="IPhone",count,0)  
    | eval iPad= if(WT_device=="IPad",count,0)  
    | eval Otros= if(WT_device=="Linux",count,0) 
    | eval WT_ti = if (WT_ti== "Mi perfil - Noticias", "Mi perfil - Novedades",WT_ti )  
    | rename WT_ti as Titulo,cs_uri_stem as URL, count as "Paginas_Vista", percent as "Porcentaje_%"
    | search Titulo=Comunidades

Attach an image of results, my problem, I need not show de Column WT_device and show the results in a single line. It's possible?
Thanks for you time!!

0 Karma
1 Solution

TISKAR
Builder

@mogoj , Can you add this please:

| stats sum(*)  as * by Titulo URL

Search compet:

 index=temp sourcetype=sdc cs_host="*mto.ree.*" WT_dl=0 NOT (cs_uri_stem ="*/es-es/paginas/inicio.aspx" OR cs_uri_stem =*/results.aspx* OR cs_uri_stem =*/_layouts/*  OR cs_uri_stem =*/_catalogs/* OR cs_uri_stem =/personal* ) 
 | fillnull value="Sin Título" WT_ti
 | top limit=0 WT_ti, cs_uri_stem,WT_device  
 | eval WT_ti= urldecode(WT_ti)
 | eval percent = round(percent,2) 
 | eval Escritorio= if(WT_device=="Escritorio",count,0)
 | eval iPhone= if(WT_device=="IPhone",count,0)  
 | eval iPad= if(WT_device=="IPad",count,0)  
 | eval Otros= if(WT_device=="Linux",count,0) 
 | eval WT_ti = if (WT_ti== "Mi perfil - Noticias", "Mi perfil - Novedades",WT_ti )  
 | rename WT_ti as Titulo,cs_uri_stem as URL, count as "Paginas_Vista", percent as "Porcentaje_%"
 | search Titulo=Comunidades
 | stats sum(*) as * by Titulo URL

View solution in original post

TISKAR
Builder

@mogoj , Can you add this please:

| stats sum(*)  as * by Titulo URL

Search compet:

 index=temp sourcetype=sdc cs_host="*mto.ree.*" WT_dl=0 NOT (cs_uri_stem ="*/es-es/paginas/inicio.aspx" OR cs_uri_stem =*/results.aspx* OR cs_uri_stem =*/_layouts/*  OR cs_uri_stem =*/_catalogs/* OR cs_uri_stem =/personal* ) 
 | fillnull value="Sin Título" WT_ti
 | top limit=0 WT_ti, cs_uri_stem,WT_device  
 | eval WT_ti= urldecode(WT_ti)
 | eval percent = round(percent,2) 
 | eval Escritorio= if(WT_device=="Escritorio",count,0)
 | eval iPhone= if(WT_device=="IPhone",count,0)  
 | eval iPad= if(WT_device=="IPad",count,0)  
 | eval Otros= if(WT_device=="Linux",count,0) 
 | eval WT_ti = if (WT_ti== "Mi perfil - Noticias", "Mi perfil - Novedades",WT_ti )  
 | rename WT_ti as Titulo,cs_uri_stem as URL, count as "Paginas_Vista", percent as "Porcentaje_%"
 | search Titulo=Comunidades
 | stats sum(*) as * by Titulo URL

mogoj
Engager

Thanks!!!!

0 Karma

FrankVl
Ultra Champion

Can you perhaps sketch the desired result (e.g. in excel or so)? I don't entirely follow what you are looking for.

0 Karma

mogoj
Engager

Hi Frank,
I have this-->
Titulo URL WT_device Paginas Vista Porcertanje Escritorio Otros Ipad iPhone
Comunidades Paginas/default.aspx Escritorio 28 8,02 28 0 0 0
Comunidades Paginas/default.aspx iPhone 2 0,57 0 0 0 2
Comunidades Paginas/default.aspx iPad 2 0,57 0 0 2 0

And i Like this-->
Titulo URL Paginas Vista Porcentaje Escritorio Otros Ipad iPhone
Comunidades Paginas/default.aspx 32 9,16 28 0 2 2

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...