Splunk Search

How to group by a by Title?

mogoj
Engager

Hi guys!!
I have this search:

    index=temp sourcetype=sdc cs_host="*mto.ree.*" WT_dl=0 NOT (cs_uri_stem ="*/es-es/paginas/inicio.aspx" OR cs_uri_stem =*/results.aspx* OR cs_uri_stem =*/_layouts/*  OR cs_uri_stem =*/_catalogs/* OR cs_uri_stem =/personal* ) 
    | fillnull value="Sin Título" WT_ti
    | top limit=0 WT_ti, cs_uri_stem,WT_device  
    | eval WT_ti= urldecode(WT_ti)
    | eval percent = round(percent,2) 
    | eval Escritorio= if(WT_device=="Escritorio",count,0)
    | eval iPhone= if(WT_device=="IPhone",count,0)  
    | eval iPad= if(WT_device=="IPad",count,0)  
    | eval Otros= if(WT_device=="Linux",count,0) 
    | eval WT_ti = if (WT_ti== "Mi perfil - Noticias", "Mi perfil - Novedades",WT_ti )  
    | rename WT_ti as Titulo,cs_uri_stem as URL, count as "Paginas_Vista", percent as "Porcentaje_%"
    | search Titulo=Comunidades

Attach an image of results, my problem, I need not show de Column WT_device and show the results in a single line. It's possible?
Thanks for you time!!

0 Karma
1 Solution

TISKAR
Builder

@mogoj , Can you add this please:

| stats sum(*)  as * by Titulo URL

Search compet:

 index=temp sourcetype=sdc cs_host="*mto.ree.*" WT_dl=0 NOT (cs_uri_stem ="*/es-es/paginas/inicio.aspx" OR cs_uri_stem =*/results.aspx* OR cs_uri_stem =*/_layouts/*  OR cs_uri_stem =*/_catalogs/* OR cs_uri_stem =/personal* ) 
 | fillnull value="Sin Título" WT_ti
 | top limit=0 WT_ti, cs_uri_stem,WT_device  
 | eval WT_ti= urldecode(WT_ti)
 | eval percent = round(percent,2) 
 | eval Escritorio= if(WT_device=="Escritorio",count,0)
 | eval iPhone= if(WT_device=="IPhone",count,0)  
 | eval iPad= if(WT_device=="IPad",count,0)  
 | eval Otros= if(WT_device=="Linux",count,0) 
 | eval WT_ti = if (WT_ti== "Mi perfil - Noticias", "Mi perfil - Novedades",WT_ti )  
 | rename WT_ti as Titulo,cs_uri_stem as URL, count as "Paginas_Vista", percent as "Porcentaje_%"
 | search Titulo=Comunidades
 | stats sum(*) as * by Titulo URL

View solution in original post

TISKAR
Builder

@mogoj , Can you add this please:

| stats sum(*)  as * by Titulo URL

Search compet:

 index=temp sourcetype=sdc cs_host="*mto.ree.*" WT_dl=0 NOT (cs_uri_stem ="*/es-es/paginas/inicio.aspx" OR cs_uri_stem =*/results.aspx* OR cs_uri_stem =*/_layouts/*  OR cs_uri_stem =*/_catalogs/* OR cs_uri_stem =/personal* ) 
 | fillnull value="Sin Título" WT_ti
 | top limit=0 WT_ti, cs_uri_stem,WT_device  
 | eval WT_ti= urldecode(WT_ti)
 | eval percent = round(percent,2) 
 | eval Escritorio= if(WT_device=="Escritorio",count,0)
 | eval iPhone= if(WT_device=="IPhone",count,0)  
 | eval iPad= if(WT_device=="IPad",count,0)  
 | eval Otros= if(WT_device=="Linux",count,0) 
 | eval WT_ti = if (WT_ti== "Mi perfil - Noticias", "Mi perfil - Novedades",WT_ti )  
 | rename WT_ti as Titulo,cs_uri_stem as URL, count as "Paginas_Vista", percent as "Porcentaje_%"
 | search Titulo=Comunidades
 | stats sum(*) as * by Titulo URL

mogoj
Engager

Thanks!!!!

0 Karma

FrankVl
Ultra Champion

Can you perhaps sketch the desired result (e.g. in excel or so)? I don't entirely follow what you are looking for.

0 Karma

mogoj
Engager

Hi Frank,
I have this-->
Titulo URL WT_device Paginas Vista Porcertanje Escritorio Otros Ipad iPhone
Comunidades Paginas/default.aspx Escritorio 28 8,02 28 0 0 0
Comunidades Paginas/default.aspx iPhone 2 0,57 0 0 0 2
Comunidades Paginas/default.aspx iPad 2 0,57 0 0 2 0

And i Like this-->
Titulo URL Paginas Vista Porcentaje Escritorio Otros Ipad iPhone
Comunidades Paginas/default.aspx 32 9,16 28 0 2 2

0 Karma
Get Updates on the Splunk Community!

Best Strategies to Optimize Observability Costs

 Join us on Tuesday, May 6, 2025, at 11 AM PDT / 2 PM EDT for an insightful session on optimizing ...

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...