Splunk Search

Using Tags to group results

richnavis
Contributor

I know that I can use tags to define a search, but can I also use them to group results? In my situation, I want to search my servers, and have them grouped by the type of servers I have. So...

I have created a tag called "Linux" and Another Tag called "Windows", then have created field value pairs to tag the servers. It it possible to then query them and get a count?

I've tried the following, but doesn't return any results.

Search tag=Linux or tag=Windows | stats count(host) by tag::host

I'm on 4.2.1

Tags (2)
0 Karma

richnavis
Contributor

So.. Found out that this is NOT possible... However, one way to do this is to create a lookup list, and then group by the fields in the lookup list..

0 Karma
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...