Hi, new to Splunk I'm trying to sort out names from my logs files as such
so far I have added a new filed "names" but it just gives me all the names of the logs mixed up as such:
I'd like to sort these out as such I'm also using one query to search for these logs and i'd like to have a nice graph with all this info. any help would be appreciated.
to sort values in a field it's very easy because you can use the sort command (see https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Sort ).
But I think that you're asking something more.
If I correctly understood, you want to group your values and count the different values for each group, is it correct?
If this is your need, you should find a rule to classify your data (e.g. the string before underscore).
In this case you can use eval command to assign a category to them, something like this:
| rex field=my_field "^(?<category>\w*)_"
| eval category=if(isnull(category),"Others",category)
| stats values(my_field) AS my_field dc(my_field) AS total BY category
View solution in original post
Awesome this worked!! thanks for this help!!
If I wanted to do a simple Count the total by just one category would I use
stats count as Total
Example: field1 gives me these values in GB