Splunk Search
Highlighted

How to group multiple field values into one field

Builder

I have logs where I want to count multiple values for a single field as "start" and other various values as "end". How would I go about this? I want to be able to show two rows or columns where I show the total number of start and end values.

index=foo (my_field=1 OR my_field=2 OR my_field=3 OR my_field=4 OR my_field=5 OR my_field=6)
| eval start = my_field=1 OR my_field=2 OR my_field=3
| eval end = my_field=4 OR my_field=5 OR my_field=6
| stats count by start end
0 Karma
Highlighted

Re: How to group multiple field values into one field

Builder

I ended up using case

index=foo (my_field=1 OR my_field=2 OR my_field=3 OR my_field=4 OR my_field=5 OR my_field=6)
| eval status=case(my_field=1 "start", my_field=2 "start", my_field=3 "start", my_field=4 "end", my_field=5 "end", my_field=6 "end")
| stats count by status

View solution in original post

Highlighted

Re: How to group multiple field values into one field

SplunkTrust
SplunkTrust

That would be the way to go. A minor cosmetic change (clubbing multiple conditions together, adding else/default forrest of values/conditions):

index=foo (my_field=1 OR my_field=2 OR my_field=3 OR my_field=4 OR my_field=5 OR my_field=6)
 | eval status=case(my_field=1 OR my_field=2 OR  my_field=3, "start", true(), "end")
 | stats count by status
0 Karma
Highlighted

Re: How to group multiple field values into one field

Explorer

You could use "in" function to check the static value list to the above query:

index=foo (myfield=1 OR myfield=2 OR myfield=3 OR myfield=4 OR myfield=5 OR myfield=6)
| eval status=case(in(myfield,1,2,3),"Start",in(myfield,4,5,6),"End",1==1,NULL)
| stats count by status

0 Karma