Splunk Search

Using regex with timechart

sarahw3
Explorer

I want to create a timechart based on 5 tags. I have tried | timechart count by tag |regex tag="Working|No_Images|Other|Never_Checked|Camera_Not_Working" and it does not work. If I get rid of the regex, it generates the timechart but it has all the tags (70+) in the chart when I only want 5. Is there another way I can make the timechart just show the 5 tags?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi sarahw3,
probably your events have more than one tag for each, you could use eval to choose only the needed five, the problem is that if an event has more than one of the five tags, it takes only the first.
try something like this

your_search
| eval event=case(tag="tag1","tag1",tag="tag2","tag2",tag="tag3","tag3",tag="tag4","tag4",tag="tag5","tag5")
| search tag=tag1 OR tag=tag2 OR tag=tag3 OR tag=tag4 OR tag=tag5
| timechart count by tag

Bye.
Giuseppe

View solution in original post

0 Karma

3no
Communicator

The easy way, will be to filter on the tags before the timechart (this will also be more efficient) :

index=foo (tag=Working OR tag=No_Images OR tag=Other OR tag=Never_Checked OR tag=Camera_Not_Working) | timechart count by tag

gcusello
SplunkTrust
SplunkTrust

Hi sarahw3,
probably your events have more than one tag for each, you could use eval to choose only the needed five, the problem is that if an event has more than one of the five tags, it takes only the first.
try something like this

your_search
| eval event=case(tag="tag1","tag1",tag="tag2","tag2",tag="tag3","tag3",tag="tag4","tag4",tag="tag5","tag5")
| search tag=tag1 OR tag=tag2 OR tag=tag3 OR tag=tag4 OR tag=tag5
| timechart count by tag

Bye.
Giuseppe

0 Karma

sarahw3
Explorer

Thank you so much!! That worked perfectly!

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...