Splunk Search

count problem

keyu921
Explorer

I have following data
email|country|license
aa|HK|365E1
bb|US|365E2
cc|HK|non-office
dd|HK|non-office
ee|UK|non-office

I would like to got bar chart that values of adopted (365E1+365E2) and non-adopted and count by country

base_search
| chart dc("email") AS Count over country by license

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
Legend

Hi @keyu921,
you should find a way to identify adopted and non adopted and use this rule in an eval command, like the one:

base_search
| eval kind=if(license="non-office","non adopted","adopted")
| chart dc("email") OVER kind BY license

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
Legend

Hi @keyu921,
you should find a way to identify adopted and non adopted and use this rule in an eval command, like the one:

base_search
| eval kind=if(license="non-office","non adopted","adopted")
| chart dc("email") OVER kind BY license

Ciao.
Giuseppe

0 Karma

keyu921
Explorer

After I review the data, I got 30 license type, I want to keep 365E1 and 365E2 for adopted and others are non-adopted
How can I eval like?
| eval kind=if(license!="%OFFICE 365%","non adopted","adopted")
| chart dc("email") OVER kind BY country

0 Karma

keyu921
Explorer

thank you i got the diagram expected after modify some query

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...