Splunk Search

Want to split results based on a field value

leandrot
Explorer

Hi all,

We have a field which represets de Offices, and we would like to make 2 different line charts separating between Domestic offices and International offices.

As Example we have:

Domestic offices: PHX, LAX, LGA
International offices: BUE, LIM, MEX

How can we filter the results to dispaly on each graphic the corresponding offices ?

Thanks in advance

Tags (1)
0 Karma

TISKAR
Builder

@leandrot , Can you try this please:

<yourSearch> |eval TypeOffice=if(Offices="PHX" OR Offices="LAX" OR Offices="LGA","Domestic offices","International offices") | chart count over Offices by TypeOffice
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...