Multiple Values for One Tag - Only Want to Display One

[alylanchester]

Hi,

I've tagged my data by location, and I am now trying to run stats on it.

Problem is a location can be Manual or Automated and relate to Bank 1 or Bank 2.

The issue I have is when running a stats, I get:

Manual Bank 1
Manual Bank 2
Automated Bank 1
Automated Bank 2

Whereas all I want to look at is Manual vs. Automated banks. Is there a way of only displaying certain tags?
If I put tag::XX!= then it doesn't run the search as the field values are tagged as both.

Thanks 🙂

[woodcock · Accepted solution]

You must be very, VERY careful when counting by tags. If an event has more than 1 tag (and that is almost always the case in every splunk deployment at least some of the time), that event will be counted more than once (once for each tag value). In any case, I would do it the way that you are and then sum it up at the end by adding this to the bottom:

... | rex field=mytag "^(?<mode>\S+)"
| stats sum(count) BY mode

That being said, I would to back and redo your tags to have 2: one for mode (which is either Automatic or Manual and one for Bank which is a number).

[alylanchester]

Thanks! Yes, didn't know if there was a way of filtering tags out so only some remained active in the field set.

[woodcock]

Yes, there is, you can use mvfilter for this.

[gcusello]

Hi alylanchester,
create an eval field with your condition to use in your stats, e.g.

your_search
| eval type=if(location="Manual*", "Manual","Automatic")
| stats count by type

Bye.
Giuseppe

[alylanchester]

There are 9999+ locations, we have tagged them all which is why I ask, instead of doing an Eval.