Splunk Search

How to group the data

haripotu
Loves-to-Learn Everything

We have the count of different fields We need to get all that data on x-axis for the that we are using appendcols more than thrice. Our data base contains huge data running search command more than once is creating a problem. We would like to group the count data. Can i please know how.

Below is the query we are using:

index="main" sourcetype="SF1"
| stats count(CASS_RESULT) as CASS by CASS_RESULT
|appendcols [search index="main" sourcetype="SF4"
| stats count(DIALOGUE_RESULT) as DIALOGUE by DIALOGUE_RESULT]
|appendcols [search index="main" sourcetype="SF2"
| stats count(TPOS_RESULT) as TPOS by TPOS_RESULT]
|appendcols [search index="main" sourcetype="SF3"
| stats count(PCO_RESULT) as PCO by PCO_RESULT]
|appendcols [search index="main" sourcetype="SF5"
| stats count(VAS_RESULT) as VAS by VAS_RESULT]
|table CASS_RESULT CASS DIALOGUE TPOS PCO VAS
| transpose header_field=CASS_RESULT
Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The way you are using appendcols means that the data in the rows has no real relationship to each other apart from the order in which they are returned from the stats commands, therefore, you could try something like this

index="main" sourcetype="SF1"
| eventstats count(CASS_RESULT) as CASS by sourcetype CASS_RESULT
| eval CASS=if(sourcetype="SF1",CASS,null())
| eval CASS_RESULT=if(sourcetype="SF1",CASS_RESULT,null())
| eventstats count(DIALOGUE_RESULT) as DIALOGUE by sourcetype DIALOGUE_RESULT
| eval DIALOGUE=if(sourcetype="SF4",DIALOGUE,null())
| eventstats count(TPOS_RESULT) as TPOS by sourcetype TPOS_RESULT
| eval TPOS=if(sourcetype="SF2",TPOS,null())
| eventstats count(PCO_RESULT) as PCO by sourcetype PCO_RESULT
| eval PCO=if(sourcetype="SF3",PCO,null())
| eventstats count(VAS_RESULT) as VAS by sourcetype VAS_RESULT
| eval VAS=if(sourcetype="SF5",VAS,null())
| table sourcetype CASS_RESULT CASS DIALOGUE TPOS PCO VAS
| dedup sourcetype CASS_RESULT CASS DIALOGUE TPOS PCO VAS
| streamstats count as row by sourcetype
| stats values(*) as * by row
| fields - row
| transpose header_field=CASS_RESULT

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...