Splunk Query Help!

[kc_prane]

I Have  Service_names  (A, B ,C ,D, E,  F, G, H, I J, K, L , M)  but want  (C ,D, E,  F, G, H, I J, K, L , M ) services_names renamed as "Other_Services"  | Stats by  services_names  | table services_names  time_Taken

Thanks in advance!

[gcusello]

Hi @kc_prane ,

ony one question: what's time_Token?

if it's a field, please try something like this:

<your_search
| eval services_names=if(services_names IN ("A", "B"), service_name, "Other_Services")
| stats values(time_Token) AS time_Token BY  services_names
| table services_names  time_Taken

 otherwise, please explain what's time_Token, or apply my approach to your search.

Ciao.

Giuseppe

[kc_prane]

Hi gcusello, Thanks for the reply,  Iam looking to get results like below.

my base search

| rex "^[^=\n]*=(?P<ServiceName>[^,]+)"
| rex "TimeMS\s\=\s(?<Trans_Time>\d+)"

Results

ServiceName	Trans_Time	Count
A	60	1111
B	40	1234
Other_Services( C , D, E, F,G,H)	25	1234567

[gcusello · Accepted solution]

Hi @kc_prane ,

you shared only a part of your search, so I cannot check it.

anyway, does it solves your requirement?

Ciao.

Giuseppe

[kc_prane]

Thanks for the help! @gcusello. I fixed my rex Iam seeing results now.