Splunk Search

How to name with statistic/visualization?

jialiu907
Path Finder

I am new to Splunk and I wanted to make a dashboard to showcase the count of Linux machines and their distributions in the environment. I have gotten the search to be almost what I want except the output statistic is wrong in the naming. 

This is the current search.

 

index=main host=* sourcetype=syslog process=elcsend "\"config " "CentOS Linux release 7.9.2009 (Core)" OR "Rocky Linux release 8.7 (Green Obsidian)" OR "Rocky Linux release 9.1 (Blue Onyx)" 
| rex "CentOS Linux release (?P<vers>\d.\d)" 
| eval vers = "CentOS ".vers 
| rex "Rocky Linux release (?P<vers>\d.\d)" 
| eval vers = "Rocky ".vers
| dedup host 
| stats count by vers
| addcoltotals label=Total labelfield=vers
| sort count desc

 

 And this is the output.splunk1.png

 

 

 

I am looking to have "Rocky CentOS 7.9" to just be named "CentOS 7.9" while the others remain as they are.

 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The problem stems from the vers field already having "CentOS" added and then "Rocky " is added.  Try extracting separate version fields.

index=main host=* sourcetype=syslog process=elcsend "\"config " "CentOS Linux release 7.9.2009 (Core)" OR "Rocky Linux release 8.7 (Green Obsidian)" OR "Rocky Linux release 9.1 (Blue Onyx)" 
| rex "CentOS Linux release (?P<vers>\d.\d)" 
| rex "Rocky Linux release (?P<vers>\d.\d)" 
index=main host=* sourcetype=syslog process=elcsend "\"config " "CentOS Linux release 7.9.2009 (Core)" OR "Rocky Linux release 8.7 (Green Obsidian)" OR "Rocky Linux release 9.1 (Blue Onyx)" 
| rex "CentOS Linux release (?P<Cvers>\d.\d)" 
| rex "Rocky Linux release (?P<Rvers>\d.\d)" 
| eval Cvers = "CentOS ".Cvers 
| eval Rvers = "Rocky ".Rvers
| eval vers = coalesce(Cvers, Rvers)
| dedup host 
| stats count by vers
| addcoltotals label=Total labelfield=vers
| sort count desc
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The problem stems from the vers field already having "CentOS" added and then "Rocky " is added.  Try extracting separate version fields.

index=main host=* sourcetype=syslog process=elcsend "\"config " "CentOS Linux release 7.9.2009 (Core)" OR "Rocky Linux release 8.7 (Green Obsidian)" OR "Rocky Linux release 9.1 (Blue Onyx)" 
| rex "CentOS Linux release (?P<vers>\d.\d)" 
| rex "Rocky Linux release (?P<vers>\d.\d)" 
index=main host=* sourcetype=syslog process=elcsend "\"config " "CentOS Linux release 7.9.2009 (Core)" OR "Rocky Linux release 8.7 (Green Obsidian)" OR "Rocky Linux release 9.1 (Blue Onyx)" 
| rex "CentOS Linux release (?P<Cvers>\d.\d)" 
| rex "Rocky Linux release (?P<Rvers>\d.\d)" 
| eval Cvers = "CentOS ".Cvers 
| eval Rvers = "Rocky ".Rvers
| eval vers = coalesce(Cvers, Rvers)
| dedup host 
| stats count by vers
| addcoltotals label=Total labelfield=vers
| sort count desc
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...