Splunk Search

Splunk Report- How to remove item from results?

revanthammineni
Path Finder

Hi Splunkers,

I have results in the following way.

Country        Count

Japan                50

USA.                   70

China.                60

India.                  50

Tokyo.                5

Goal:

I want to add the count of Tokyo to Japan (55) and take off Tokyo from the results. Could anyone suggest me with a logic. TIA

Labels (1)
Tags (2)
0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @revanthammineni 

Just add following line in at the of the query  or before stats/chart/ that you are using in query 

| eval Country=if(Country="Tokyo","Japan",Country)

 

 

----
Regards,
Sanjay Reddy

----
If this reply helps you, Karma would be appreciated.
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...