Splunk Search

How to rename search results obtained in stats?

Nidd
Path Finder

I have the following query created:

 

 

index=my_idx source=mySource | stats count by sourceTopic

 

 

Which gives me result like:

 

 

MY/EVENTS/EV1/TYPE1	| 16170
MY/EVENTS/EV1/TYPE2	| 3558
MY/EVENTS/EV1/TYPE3	| 419
MY/EVENTS/EV2/TYPE1	| 123391
MY/EVENTS/EV2/TYPE2	| 16734
MY/EVENTS/EV2/TYPE3	| 880

 

 

But I would need my result like:

 

 

TYPE1 EV1   | 16170
TYPE2 EV1   | 3558
TYPE3 EV1   | 419
TYPE1 EV2   | 123391
TYPE2 EV2   | 16734
TYPE3 EV2   | 880

 

 

How would I achieve this? How can I rename my values that I obtain in stats?

Labels (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

In general, the replace command can be use to change values in stats results.

| stats count by sourceTopic
| replace "foo" with "bar" in sourceTopic

That probably won't do the job in this case, though.

We can use rex to extract the desired parts from the sourceTopic field and then rearrange them.

| rex field=sourceTopic "[^\/]+\/[^\/]+\/(?<f3>[^\/]+)\/(?<f4>.*)"
| eval sourceTopic = f4 . " " . f3
| table sourceTopic count

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

Nidd
Path Finder

Thanks much @richgalloway  !! It worked!

richgalloway
SplunkTrust
SplunkTrust

In general, the replace command can be use to change values in stats results.

| stats count by sourceTopic
| replace "foo" with "bar" in sourceTopic

That probably won't do the job in this case, though.

We can use rex to extract the desired parts from the sourceTopic field and then rearrange them.

| rex field=sourceTopic "[^\/]+\/[^\/]+\/(?<f3>[^\/]+)\/(?<f4>.*)"
| eval sourceTopic = f4 . " " . f3
| table sourceTopic count

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...