Splunk Search

Is it possible to combine field variables into one field variable, but keep it in the same field?

demkic
Explorer

Hi all,
Is it possible to combine several field variables into one variable but keep it in the same field? Here is an example:

If my result output looks like so:

Successfully            5
Failed                  10
Failure                 5
Success                 30

I would like to be able to combine the variable "Successfully" and "Success" (along with their corresponding count value) and name the variable "Success" ... essentially this is what I would like to display when combining terms and values:

Success                 35
Fail                    15

I hope this makes sense?

Thank you!

0 Karma
1 Solution

gokadroid
Motivator

Based on your comments below the question lets say if the field myField has strings Successfully, Success, Failure and Failed and count has its count then can you try below:

 your stats query to return myField and count
| eval newField=case(myField="Success" OR myField="Successfully", "Success", myField="Failure" OR myField="Failed", "Fail", 1=1, "dummy")
| stats sum(count) by newField

OR if you wanna reuse the field, try if this works for you:

your stats query to return myField and count
| eval myField=case(myField="Success" OR myField="Successfully", "Success", myField="Failure" OR myField="Failed", "Fail", 1=1, "dummy")
| stats sum(count) by myField

View solution in original post

gokadroid
Motivator

Based on your comments below the question lets say if the field myField has strings Successfully, Success, Failure and Failed and count has its count then can you try below:

 your stats query to return myField and count
| eval newField=case(myField="Success" OR myField="Successfully", "Success", myField="Failure" OR myField="Failed", "Fail", 1=1, "dummy")
| stats sum(count) by newField

OR if you wanna reuse the field, try if this works for you:

your stats query to return myField and count
| eval myField=case(myField="Success" OR myField="Successfully", "Success", myField="Failure" OR myField="Failed", "Fail", 1=1, "dummy")
| stats sum(count) by myField

niketn
Legend

Yes eval can be used and if other fields are not required they can be removed:

eval Success=Success+Successfully| eval Fail=Failure+Failed | fields - Successfully Failure Failed

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...