grouping multiple values of a field into one for charting

[sathiyamoorthy]

Sample Data: Following is the result for a field which I'm tried to do chart for,

• Linux - 10%
• Unix - 10%
• Firefox - 40%
• Windows - 20%
• IE - 20%

Instead of showing chart with above values, what should I do to view the following:

• Open source - 60%
• Commercial - 40%

Open source is the grouping of the values (Linux, Unix, Firefox), and commercial is Windows and IE. So how to group multiple values of a single field into one for charting, and how to give it some name? Any help is much appreciated, thanks.

[Ayn · Accepted solution]

You could use eval and case to create groups like that. Let's say that your original field name is "system_id" and that you want to group values for this field and write that to the field "system_type". The, you'd do something like this:

... | eval system_type=case(system_id=="Linux" OR system_id=="Unix" OR system_id=="Firefox","Open source",system_id=="Windows" OR system_id=="IE","Commercial")

You can then use the system_type field in your chart.

[HattrickNZ]

can i use wild cards in the case statement? e.g. system_type=case(system_id=="Linux*" OR system_id=="Unix*")

[mjm295]

Did anyone get the wild cards working?

[vsingla1]

Hi HattrickNZ and mjm295,
Wildcard does not work with case as expected. small trick is to use match within the case.
Check the answer here:
https://answers.splunk.com/answers/55524/eval-wildcards.html