Splunk Search

Using regex with timechart

sarahw3
Explorer

I want to create a timechart based on 5 tags. I have tried | timechart count by tag |regex tag="Working|No_Images|Other|Never_Checked|Camera_Not_Working" and it does not work. If I get rid of the regex, it generates the timechart but it has all the tags (70+) in the chart when I only want 5. Is there another way I can make the timechart just show the 5 tags?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi sarahw3,
probably your events have more than one tag for each, you could use eval to choose only the needed five, the problem is that if an event has more than one of the five tags, it takes only the first.
try something like this

your_search
| eval event=case(tag="tag1","tag1",tag="tag2","tag2",tag="tag3","tag3",tag="tag4","tag4",tag="tag5","tag5")
| search tag=tag1 OR tag=tag2 OR tag=tag3 OR tag=tag4 OR tag=tag5
| timechart count by tag

Bye.
Giuseppe

View solution in original post

0 Karma

3no
Communicator

The easy way, will be to filter on the tags before the timechart (this will also be more efficient) :

index=foo (tag=Working OR tag=No_Images OR tag=Other OR tag=Never_Checked OR tag=Camera_Not_Working) | timechart count by tag

gcusello
SplunkTrust
SplunkTrust

Hi sarahw3,
probably your events have more than one tag for each, you could use eval to choose only the needed five, the problem is that if an event has more than one of the five tags, it takes only the first.
try something like this

your_search
| eval event=case(tag="tag1","tag1",tag="tag2","tag2",tag="tag3","tag3",tag="tag4","tag4",tag="tag5","tag5")
| search tag=tag1 OR tag=tag2 OR tag=tag3 OR tag=tag4 OR tag=tag5
| timechart count by tag

Bye.
Giuseppe

0 Karma

sarahw3
Explorer

Thank you so much!! That worked perfectly!

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...