help with tstats and eval

[a212830]

Hi,

I'm trying to count the number of events for a specific index/sourcetype combo, and then total them into a new field, using eval. I've tried this, but looks like my logic is off, as the numbers are very weird - looks like it's counting the number of splunk servers. I want to count the number of events per splunk_server and then total them into a new field named splunk_region.

|tstats count WHERE index=cisco AND sourcetype="cisco:asa" by  splunk_server _time
| eval splunk_region = case(like(splunk_server,"%bos-%"),"BOS" , 
like(splunk_server, "dfw-%"),"DFW",
like(splunk_server, "%lax-%"), "LAX", 
like(splunk_server, "%"),"OTHER") 
| timechart span=1d count by splunk_region

[woodcock · Accepted solution]

Like this:

|tstats count WHERE index=cisco AND sourcetype="cisco:asa" BY splunk_server _time span=1d
| eval splunk_region = case(
   like(splunk_server,"%bos-%"),  "BOS", 
   like(splunk_server, "dfw-%"),  "DFW",
   like(splunk_server, "%lax-%"), "LAX", 
   true(),                        "OTHER") 
| timechart span=1d sum(count) AS count BY splunk_region