Splunk Search

How to include a field in a count if it has some particular text?

hastrike
New Member

I have pulled a list of all the Operating systems in the environment. Although, they are all server 2008, for example, some are standard, enterprise, datacenter, etc.... Did a stats count to get a count of the number of each operating system in the environment. However, I would like to combine the stats count results for anything that is just Server 2008, 2012, or XP. How can I combine these results into one entry for Server 2008 and then one for server 2012? The count values would then combine as well.

In Excel I know I can do a count If (COLUMN, "*2008*") and it will count anything that has 2008 in the OS column. Is there anything like that in Splunk?

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

your current search with stats giving fields osType and count | eval osType=case(like(osType,"%2008%"),"Win Server 2008",like(osType,"%2012%"),"Win Server 2008",1=1."Windows XP") | stats sum(count) as count by osType

View solution in original post

0 Karma

somesoni2
Revered Legend

Try something like this

your current search with stats giving fields osType and count | eval osType=case(like(osType,"%2008%"),"Win Server 2008",like(osType,"%2012%"),"Win Server 2008",1=1."Windows XP") | stats sum(count) as count by osType
0 Karma

hastrike
New Member

Thank you for the input

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...