Splunk Search

Joining multiple field value count using a common text

Contributor

Hi,

We have few appliances spread across various data centers feeding logs into Splunk. Each Data center has 2 or more of such appliances depending on load. Hostname for the device is already an extracted field and is being used to chart individual count.

What I would like to do now, is to combine the results based on DC but the problem is that the DC identifier is part of the hostname and not a separate field. e.g. DC01APP1, DC01APP2, DC02APP1, DC02APP2. Now, instead of listing count for all 4 individually, I'd like to list for "DC01" and "DC02", where "DC01" should contain the aggregate count for DC01(APP1/APP2).

Is there any eval function which might help in achieving this or would i have to extract the DC part again from an existing field?

Many Thanks,

~ Abhi

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Yes there is

your base search giving count by hostname | eval hostname=substr(hostname,1,4) | stats sum(count) as count by hostname

View solution in original post

SplunkTrust
SplunkTrust

You could extract the DC name using rex and then aggregate on the new field. For example,

your base search | rex field=hostname "(?<DC>DC\d\d)" | stats count by DC ...
---
If this reply helps you, an upvote would be appreciated.

SplunkTrust
SplunkTrust

Yes there is

your base search giving count by hostname | eval hostname=substr(hostname,1,4) | stats sum(count) as count by hostname

View solution in original post

Contributor

Thank you. Exactly what I was looking for.

0 Karma