Splunk Search

Normalise the values of a field and joining the event count of the field values

sumaitasiddiky1
New Member

Hi, I have a list of Tenants and the data is being pulled from Jira labels.

Some of the labels have not been spelled right . For example, one of the Tenants PLATFORM have been labelled as PLAFORM, PLATFROM, PLATFORMATFORM. Each of these labels have an event associated with it.

There are many Tenants like this. I want a query to merge these Values and events of Tenant field as ONE.

There are 99 more Tenants so I want a query that I can apply for other Tenant values normalisation as well.

At the moment the view is :

Tenant Count
PLAFORM 6
PLATFROM 8
PLATFORMATFROM 15

I want it like :

Tenant Count
PLATFORM 29

Tags (1)
0 Karma

koshyk
Super Champion

So from the existing output.. say

Tenant Count
PLAFORM 6
PLATFROM 8
PLATFORMATFROM 15

do a

... | eval Tenant=if(like(Tenant, "PLA%"), "PLATFORM", "UNKNOWN")
| stats sum(Count) as Tenant_Count  by Tenant
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...