Splunk Search

How to include a field in a count if it has some particular text?

hastrike
New Member

I have pulled a list of all the Operating systems in the environment. Although, they are all server 2008, for example, some are standard, enterprise, datacenter, etc.... Did a stats count to get a count of the number of each operating system in the environment. However, I would like to combine the stats count results for anything that is just Server 2008, 2012, or XP. How can I combine these results into one entry for Server 2008 and then one for server 2012? The count values would then combine as well.

In Excel I know I can do a count If (COLUMN, "*2008*") and it will count anything that has 2008 in the OS column. Is there anything like that in Splunk?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try something like this

your current search with stats giving fields osType and count | eval osType=case(like(osType,"%2008%"),"Win Server 2008",like(osType,"%2012%"),"Win Server 2008",1=1."Windows XP") | stats sum(count) as count by osType

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this

your current search with stats giving fields osType and count | eval osType=case(like(osType,"%2008%"),"Win Server 2008",like(osType,"%2012%"),"Win Server 2008",1=1."Windows XP") | stats sum(count) as count by osType
0 Karma

hastrike
New Member

Thank you for the input

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...