Splunk Search

How to query where I can display x and y values as the top value?

abhi04
Communicator

I have a tag which has four values i.e. a,b,x,y. But I want to display only the x and y values as the top value. I tried the below query but it is not working.

Source title=webatm* | eval t=if(tag==x OR tag==y)|top t
0 Karma
1 Solution

micahkemp
Champion

Try:

 | eval t=if(tag="x" OR tag="y", tag, NULL)|top t

Inside an if (or other eval function), an un-quoted string represents a field name, and a quoted string represents the string itself.

Or, for multivalue fields, try:

| eval t=mvfilter(match(tag, "x") OR match(tag, "y"))
| top t

View solution in original post

0 Karma

micahkemp
Champion

Try:

 | eval t=if(tag="x" OR tag="y", tag, NULL)|top t

Inside an if (or other eval function), an un-quoted string represents a field name, and a quoted string represents the string itself.

Or, for multivalue fields, try:

| eval t=mvfilter(match(tag, "x") OR match(tag, "y"))
| top t
0 Karma

abhi04
Communicator

Hi micahkemp,

The above query is including all the values a,b,x,y and not x,y only.
It's returning same as below query.
Source type=webatm*|top tag

I want only x and y values.

0 Karma

micahkemp
Champion

It doesn't when I run it:

| makeresults count=6| eval tag="x"
| append [| makeresults count=10 | eval tag="y"]
| append [| makeresults count=20 | eval tag="z"]
| eval t=if(tag="x" OR tag="y", tag, NULL)|top t

Is your tag value a multivalue field, perhaps, where one event has multiple values for tag? If that is the case try this instead:

| eval t=mvfilter(match(tag, "x") OR match(tag, "y"))
|top t
0 Karma

abhi04
Communicator

Thanks Micahkemp.

It was anmultivalue field and the mvfilter is working.
Appreciated your help.Thanks a ton

0 Karma

micahkemp
Champion

Great! I've added the mvfilter version to my answer. If that answer solves your issue, please accept it so the question no longer appears open, and others have an easier time finding the answer.

0 Karma

abhi04
Communicator

It still shows the percentage among all the values i.e. a,b,x,y and not between x and y only.

The above query result shows the same as below query

Source type=webatm* |top tag

But this is including all a,b,x and y values which I don't want.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...