Splunk Search

Normalise the values of a field and joining the event count of the field values

sumaitasiddiky1
New Member

Hi, I have a list of Tenants and the data is being pulled from Jira labels.

Some of the labels have not been spelled right . For example, one of the Tenants PLATFORM have been labelled as PLAFORM, PLATFROM, PLATFORMATFORM. Each of these labels have an event associated with it.

There are many Tenants like this. I want a query to merge these Values and events of Tenant field as ONE.

There are 99 more Tenants so I want a query that I can apply for other Tenant values normalisation as well.

At the moment the view is :

Tenant Count
PLAFORM 6
PLATFROM 8
PLATFORMATFROM 15

I want it like :

Tenant Count
PLATFORM 29

Tags (1)
0 Karma

koshyk
Super Champion

So from the existing output.. say

Tenant Count
PLAFORM 6
PLATFROM 8
PLATFORMATFROM 15

do a

... | eval Tenant=if(like(Tenant, "PLA%"), "PLATFORM", "UNKNOWN")
| stats sum(Count) as Tenant_Count  by Tenant
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...