Splunk Search

How to name with statistic/visualization?

jialiu907
Path Finder

I am new to Splunk and I wanted to make a dashboard to showcase the count of Linux machines and their distributions in the environment. I have gotten the search to be almost what I want except the output statistic is wrong in the naming. 

This is the current search.

 

index=main host=* sourcetype=syslog process=elcsend "\"config " "CentOS Linux release 7.9.2009 (Core)" OR "Rocky Linux release 8.7 (Green Obsidian)" OR "Rocky Linux release 9.1 (Blue Onyx)" 
| rex "CentOS Linux release (?P<vers>\d.\d)" 
| eval vers = "CentOS ".vers 
| rex "Rocky Linux release (?P<vers>\d.\d)" 
| eval vers = "Rocky ".vers
| dedup host 
| stats count by vers
| addcoltotals label=Total labelfield=vers
| sort count desc

 

 And this is the output.splunk1.png

 

 

 

I am looking to have "Rocky CentOS 7.9" to just be named "CentOS 7.9" while the others remain as they are.

 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The problem stems from the vers field already having "CentOS" added and then "Rocky " is added.  Try extracting separate version fields.

index=main host=* sourcetype=syslog process=elcsend "\"config " "CentOS Linux release 7.9.2009 (Core)" OR "Rocky Linux release 8.7 (Green Obsidian)" OR "Rocky Linux release 9.1 (Blue Onyx)" 
| rex "CentOS Linux release (?P<vers>\d.\d)" 
| rex "Rocky Linux release (?P<vers>\d.\d)" 
index=main host=* sourcetype=syslog process=elcsend "\"config " "CentOS Linux release 7.9.2009 (Core)" OR "Rocky Linux release 8.7 (Green Obsidian)" OR "Rocky Linux release 9.1 (Blue Onyx)" 
| rex "CentOS Linux release (?P<Cvers>\d.\d)" 
| rex "Rocky Linux release (?P<Rvers>\d.\d)" 
| eval Cvers = "CentOS ".Cvers 
| eval Rvers = "Rocky ".Rvers
| eval vers = coalesce(Cvers, Rvers)
| dedup host 
| stats count by vers
| addcoltotals label=Total labelfield=vers
| sort count desc
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The problem stems from the vers field already having "CentOS" added and then "Rocky " is added.  Try extracting separate version fields.

index=main host=* sourcetype=syslog process=elcsend "\"config " "CentOS Linux release 7.9.2009 (Core)" OR "Rocky Linux release 8.7 (Green Obsidian)" OR "Rocky Linux release 9.1 (Blue Onyx)" 
| rex "CentOS Linux release (?P<vers>\d.\d)" 
| rex "Rocky Linux release (?P<vers>\d.\d)" 
index=main host=* sourcetype=syslog process=elcsend "\"config " "CentOS Linux release 7.9.2009 (Core)" OR "Rocky Linux release 8.7 (Green Obsidian)" OR "Rocky Linux release 9.1 (Blue Onyx)" 
| rex "CentOS Linux release (?P<Cvers>\d.\d)" 
| rex "Rocky Linux release (?P<Rvers>\d.\d)" 
| eval Cvers = "CentOS ".Cvers 
| eval Rvers = "Rocky ".Rvers
| eval vers = coalesce(Cvers, Rvers)
| dedup host 
| stats count by vers
| addcoltotals label=Total labelfield=vers
| sort count desc
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...