Splunk Search

How to include a field in a count if it has some particular text?

hastrike
New Member

I have pulled a list of all the Operating systems in the environment. Although, they are all server 2008, for example, some are standard, enterprise, datacenter, etc.... Did a stats count to get a count of the number of each operating system in the environment. However, I would like to combine the stats count results for anything that is just Server 2008, 2012, or XP. How can I combine these results into one entry for Server 2008 and then one for server 2012? The count values would then combine as well.

In Excel I know I can do a count If (COLUMN, "*2008*") and it will count anything that has 2008 in the OS column. Is there anything like that in Splunk?

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

your current search with stats giving fields osType and count | eval osType=case(like(osType,"%2008%"),"Win Server 2008",like(osType,"%2012%"),"Win Server 2008",1=1."Windows XP") | stats sum(count) as count by osType

View solution in original post

0 Karma

somesoni2
Revered Legend

Try something like this

your current search with stats giving fields osType and count | eval osType=case(like(osType,"%2008%"),"Win Server 2008",like(osType,"%2012%"),"Win Server 2008",1=1."Windows XP") | stats sum(count) as count by osType
0 Karma

hastrike
New Member

Thank you for the input

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...