Splunk Search

Is it possible to combine field variables into one field variable, but keep it in the same field?

demkic
Explorer

Hi all,
Is it possible to combine several field variables into one variable but keep it in the same field? Here is an example:

If my result output looks like so:

Successfully            5
Failed                  10
Failure                 5
Success                 30

I would like to be able to combine the variable "Successfully" and "Success" (along with their corresponding count value) and name the variable "Success" ... essentially this is what I would like to display when combining terms and values:

Success                 35
Fail                    15

I hope this makes sense?

Thank you!

0 Karma
1 Solution

gokadroid
Motivator

Based on your comments below the question lets say if the field myField has strings Successfully, Success, Failure and Failed and count has its count then can you try below:

 your stats query to return myField and count
| eval newField=case(myField="Success" OR myField="Successfully", "Success", myField="Failure" OR myField="Failed", "Fail", 1=1, "dummy")
| stats sum(count) by newField

OR if you wanna reuse the field, try if this works for you:

your stats query to return myField and count
| eval myField=case(myField="Success" OR myField="Successfully", "Success", myField="Failure" OR myField="Failed", "Fail", 1=1, "dummy")
| stats sum(count) by myField

View solution in original post

gokadroid
Motivator

Based on your comments below the question lets say if the field myField has strings Successfully, Success, Failure and Failed and count has its count then can you try below:

 your stats query to return myField and count
| eval newField=case(myField="Success" OR myField="Successfully", "Success", myField="Failure" OR myField="Failed", "Fail", 1=1, "dummy")
| stats sum(count) by newField

OR if you wanna reuse the field, try if this works for you:

your stats query to return myField and count
| eval myField=case(myField="Success" OR myField="Successfully", "Success", myField="Failure" OR myField="Failed", "Fail", 1=1, "dummy")
| stats sum(count) by myField

niketn
Legend

Yes eval can be used and if other fields are not required they can be removed:

eval Success=Success+Successfully| eval Fail=Failure+Failed | fields - Successfully Failure Failed

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...