Splunk Search

Lookup csv file different code with same meaning

indeed_2000
Motivator

Hi I have csv file that contain my errorcodes and meaning of them. I import this csv as lookup.

the problem is some codes have same meaning and when I get report show them separately

e.g

Here is the my csv:

code meaning

404    Page not found

402    Page not found

 

Current output:

Code            Meaning                         Count         

404            Page not found                  25                     

402            Page not found                  25

 

I need to consider them as one and count them like this:

Code                     Meaning                                  TotalCount

404, 402            Page not found                           50

 

FYI: if meaning are same consider they are same and able to count them

 

any idea?

Thanks

Labels (5)
Tags (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| lookup codes.csv
| stats values(code) as code count by meaning
| eval code=mvjoin(code,",")

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| lookup codes.csv
| stats values(code) as code count by meaning
| eval code=mvjoin(code,",")
0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...