Splunk Search

Using regex with timechart

sarahw3
Explorer

I want to create a timechart based on 5 tags. I have tried | timechart count by tag |regex tag="Working|No_Images|Other|Never_Checked|Camera_Not_Working" and it does not work. If I get rid of the regex, it generates the timechart but it has all the tags (70+) in the chart when I only want 5. Is there another way I can make the timechart just show the 5 tags?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi sarahw3,
probably your events have more than one tag for each, you could use eval to choose only the needed five, the problem is that if an event has more than one of the five tags, it takes only the first.
try something like this

your_search
| eval event=case(tag="tag1","tag1",tag="tag2","tag2",tag="tag3","tag3",tag="tag4","tag4",tag="tag5","tag5")
| search tag=tag1 OR tag=tag2 OR tag=tag3 OR tag=tag4 OR tag=tag5
| timechart count by tag

Bye.
Giuseppe

View solution in original post

0 Karma

3no
Communicator

The easy way, will be to filter on the tags before the timechart (this will also be more efficient) :

index=foo (tag=Working OR tag=No_Images OR tag=Other OR tag=Never_Checked OR tag=Camera_Not_Working) | timechart count by tag

gcusello
SplunkTrust
SplunkTrust

Hi sarahw3,
probably your events have more than one tag for each, you could use eval to choose only the needed five, the problem is that if an event has more than one of the five tags, it takes only the first.
try something like this

your_search
| eval event=case(tag="tag1","tag1",tag="tag2","tag2",tag="tag3","tag3",tag="tag4","tag4",tag="tag5","tag5")
| search tag=tag1 OR tag=tag2 OR tag=tag3 OR tag=tag4 OR tag=tag5
| timechart count by tag

Bye.
Giuseppe

0 Karma

sarahw3
Explorer

Thank you so much!! That worked perfectly!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...