Splunk Search

count problem

keyu921
Explorer

I have following data
email|country|license
aa|HK|365E1
bb|US|365E2
cc|HK|non-office
dd|HK|non-office
ee|UK|non-office

I would like to got bar chart that values of adopted (365E1+365E2) and non-adopted and count by country

base_search
| chart dc("email") AS Count over country by license

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @keyu921,
you should find a way to identify adopted and non adopted and use this rule in an eval command, like the one:

base_search
| eval kind=if(license="non-office","non adopted","adopted")
| chart dc("email") OVER kind BY license

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @keyu921,
you should find a way to identify adopted and non adopted and use this rule in an eval command, like the one:

base_search
| eval kind=if(license="non-office","non adopted","adopted")
| chart dc("email") OVER kind BY license

Ciao.
Giuseppe

0 Karma

keyu921
Explorer

After I review the data, I got 30 license type, I want to keep 365E1 and 365E2 for adopted and others are non-adopted
How can I eval like?
| eval kind=if(license!="%OFFICE 365%","non adopted","adopted")
| chart dc("email") OVER kind BY country

0 Karma

keyu921
Explorer

thank you i got the diagram expected after modify some query

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...