Splunk Search

How to group some of field value into new fields value?

syazwani
Path Finder

Hi peeps,

Need help to do some query. Basically I'm trying to group some of field value in the 'Category' field into new fields call 'newCategory'. Below are the sample of data:

syazwani_0-1668417552002.png

The newCategory field will have the new count for each of the new field value (such as Anonymizers, Gambling, Malicious Site).

Please help. 

Thank you.

 

Labels (4)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

This depends a lot on when you want this transformation.  If you want to see transformation before stats, it will depends on data characteristics.  Now, assuming you only want the transformation after | stats count by category, you can do

| eval newCategory = case(category IN ("Anonymizers", "Anonymizing Utilities", "Anonymizing Utilities, Internet Services"), "Anonymizers", category LIKE "Gambling%", "Gambling", category LIKE "Malicious Sites%", "Malicious Sites", true(), "Undef")

 

View solution in original post

Tags (1)

syazwani
Path Finder

Hi @yuanliu , thanks for reply. This solution worked. I try to do 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

This depends a lot on when you want this transformation.  If you want to see transformation before stats, it will depends on data characteristics.  Now, assuming you only want the transformation after | stats count by category, you can do

| eval newCategory = case(category IN ("Anonymizers", "Anonymizing Utilities", "Anonymizing Utilities, Internet Services"), "Anonymizers", category LIKE "Gambling%", "Gambling", category LIKE "Malicious Sites%", "Malicious Sites", true(), "Undef")

 

Tags (1)
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...