Splunk Search

group source types

athorat
Communicator

Hi

I am getting the list of sourcetype and its usage in GB.
index=_internal source=*metrics.log | eval GB=kb/(1024*1024) | search group="per_sourcetype_thruput" | timechart span=1d sum(GB) by series limit=0 | sort -sourcetype

Want to group/categorize certain source types , like those with ecsweb:prod:E1, ecsweb:prod:E2 and ecsweb:prod:E3 in Category Prod.

Tried using the following query which does not work.
index=_internal source=metrics.log | eval GB=kb/(1024*1024) | search group="per_sourcetype_thruput" | timechart span=1d sum(GB) by series limit=0 | sort +sourcetype| eval series =if(series ="ecsweb:", "PROD", series)

Tags (2)
0 Karma

athorat
Communicator

I am not sure about rex because the soruce types are being captured only challenge is to bucket them by name/similar names types into specific categories.

0 Karma

mmccul
SplunkTrust
SplunkTrust

That's the point. You're capturing the sourcetypes into a field. A transform to define a new field with the reduced portion allows you to clump them according to the pattern you identified into a new field. rex field=sourcetype "^[^:]+:(?<newsrctyp>.*)" would strip out the portion up to and including the first colon for you and place into the field newsrctyp, which is now grouped.

0 Karma

athorat
Communicator

Hey So the sources are coming in a field called series

index=_internal source=*metrics.log | eval GB=kb/(1024*1024) | search group="per_sourcetype_thruput" | timechart span=1d sum(GB) by series limit=0 | sort -sourcetype|

so the source type here should be Series? Tried both, no luck.
rex field=sourcetype "^[^:]+:(?<newsrctyp>.*)"

Correct me if I am wrong.

Thanks,
Anil.

0 Karma

mmccul
SplunkTrust
SplunkTrust

Run a rex to create a new field based on the sourcetype to capture the portion of the sourcetype you care about. Use that new transformed sourcetype field instead.

0 Karma

athorat
Communicator

Filtering by sourcetype=ecsweb:prod:E* does return any results.
So the goal is, when the first query returns the results. The source types should be categorised into buckets.
like ECSweb:PROD :to PROD
ECSweb:PERF:
to PERF.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

You can try this, again this shouldnt be in your _internal index...

index=_internal source=metrics.log group="per_sourcetype_thruput" | rex field=sourcetype "ecsweb:(?<newsrc>.*)" | eval GB=kb/(1024*1024) | timechart span=1d sum(GB) by newsrc | sort -newsrc

0 Karma

athorat
Communicator

Throws an error as it has by series and by newsrc

Didnt get you this shouldnt be in your _internal index...???

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Updated search, please try.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Something like this? However this sourcetype shouldnt be in _internal...

index=_internal source=metrics.log group="per_sourcetype_thruput" sourcetype=ecsweb:prod:E* | eval GB=kb/(1024*1024) | timechart span=1d sum(GB) by series limit=0 | sort +sourcetype

0 Karma
Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...