Splunk Search

How to name with statistic/visualization?

jialiu907
Path Finder

I am new to Splunk and I wanted to make a dashboard to showcase the count of Linux machines and their distributions in the environment. I have gotten the search to be almost what I want except the output statistic is wrong in the naming. 

This is the current search.

 

index=main host=* sourcetype=syslog process=elcsend "\"config " "CentOS Linux release 7.9.2009 (Core)" OR "Rocky Linux release 8.7 (Green Obsidian)" OR "Rocky Linux release 9.1 (Blue Onyx)" 
| rex "CentOS Linux release (?P<vers>\d.\d)" 
| eval vers = "CentOS ".vers 
| rex "Rocky Linux release (?P<vers>\d.\d)" 
| eval vers = "Rocky ".vers
| dedup host 
| stats count by vers
| addcoltotals label=Total labelfield=vers
| sort count desc

 

 And this is the output.splunk1.png

 

 

 

I am looking to have "Rocky CentOS 7.9" to just be named "CentOS 7.9" while the others remain as they are.

 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The problem stems from the vers field already having "CentOS" added and then "Rocky " is added.  Try extracting separate version fields.

index=main host=* sourcetype=syslog process=elcsend "\"config " "CentOS Linux release 7.9.2009 (Core)" OR "Rocky Linux release 8.7 (Green Obsidian)" OR "Rocky Linux release 9.1 (Blue Onyx)" 
| rex "CentOS Linux release (?P<vers>\d.\d)" 
| rex "Rocky Linux release (?P<vers>\d.\d)" 
index=main host=* sourcetype=syslog process=elcsend "\"config " "CentOS Linux release 7.9.2009 (Core)" OR "Rocky Linux release 8.7 (Green Obsidian)" OR "Rocky Linux release 9.1 (Blue Onyx)" 
| rex "CentOS Linux release (?P<Cvers>\d.\d)" 
| rex "Rocky Linux release (?P<Rvers>\d.\d)" 
| eval Cvers = "CentOS ".Cvers 
| eval Rvers = "Rocky ".Rvers
| eval vers = coalesce(Cvers, Rvers)
| dedup host 
| stats count by vers
| addcoltotals label=Total labelfield=vers
| sort count desc
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The problem stems from the vers field already having "CentOS" added and then "Rocky " is added.  Try extracting separate version fields.

index=main host=* sourcetype=syslog process=elcsend "\"config " "CentOS Linux release 7.9.2009 (Core)" OR "Rocky Linux release 8.7 (Green Obsidian)" OR "Rocky Linux release 9.1 (Blue Onyx)" 
| rex "CentOS Linux release (?P<vers>\d.\d)" 
| rex "Rocky Linux release (?P<vers>\d.\d)" 
index=main host=* sourcetype=syslog process=elcsend "\"config " "CentOS Linux release 7.9.2009 (Core)" OR "Rocky Linux release 8.7 (Green Obsidian)" OR "Rocky Linux release 9.1 (Blue Onyx)" 
| rex "CentOS Linux release (?P<Cvers>\d.\d)" 
| rex "Rocky Linux release (?P<Rvers>\d.\d)" 
| eval Cvers = "CentOS ".Cvers 
| eval Rvers = "Rocky ".Rvers
| eval vers = coalesce(Cvers, Rvers)
| dedup host 
| stats count by vers
| addcoltotals label=Total labelfield=vers
| sort count desc
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...