Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: grouping multiple values of a field into one f...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sample Data: Following is the result for a field which I'm tried to do chart for,
- Linux - 10%
- Unix - 10%
- Firefox - 40%
- Windows - 20%
- IE - 20%
Instead of showing chart with above values, what should I do to view the following:
- Open source - 60%
- Commercial - 40%
Open source is the grouping of the values (Linux, Unix, Firefox), and commercial is Windows and IE. So how to group multiple values of a single field into one for charting, and how to give it some name? Any help is much appreciated, thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could use eval and case to create groups like that. Let's say that your original field name is "system_id" and that you want to group values for this field and write that to the field "system_type". The, you'd do something like this:
... | eval system_type=case(system_id=="Linux" OR system_id=="Unix" OR system_id=="Firefox","Open source",system_id=="Windows" OR system_id=="IE","Commercial")
You can then use the system_type field in your chart.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could use eval and case to create groups like that. Let's say that your original field name is "system_id" and that you want to group values for this field and write that to the field "system_type". The, you'd do something like this:
... | eval system_type=case(system_id=="Linux" OR system_id=="Unix" OR system_id=="Firefox","Open source",system_id=="Windows" OR system_id=="IE","Commercial")
You can then use the system_type field in your chart.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
can i use wild cards in the case statement? e.g. system_type=case(system_id=="Linux*" OR system_id=="Unix*")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did anyone get the wild cards working?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi HattrickNZ and mjm295,
Wildcard does not work with case as expected. small trick is to use match within the case.
Check the answer here:
https://answers.splunk.com/answers/55524/eval-wildcards.html
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
