Getting Data In

how to differentiate single sourcetype based on 3 different OS using eval

dtccsundar
Path Finder

I have a single sourcetype where i need to differentiate the same sourcetype into 3 different categories based on OS field .I tried using append but since takes lot of memory by calling same sourcetype 3 different times ,i need a different approach instead of append.

My code :

index=A sourcetype=Server
| fillnull value=""
| eval OS=case(like(Operating_System,"%Windows%"),"Windows",like(Operating_System,"%Linux%"),"Linux",like(Operating_System,"%Missing%"),"Others",like(Operating_System,"%Solaris%"),"Solaris",like(Operating_System,"%AIX%"),"AIX",1=1,"Others")
| eval Environment=case(like(Environment,"%Prod%"),"Prod",like(Environment,"%Production%"),"Prod",1=1,Environment)
| search OS="Linux" OR OS="Solaris" AND Environment="PSE" OR Environment="Prod" AND Eligibility="Upper" AND Status="Installed"
| eval group="Unix Server"

| append
[| search index=A sourcetype=Server
| fillnull value=""
| eval OS=case(like(Operating_System,"%Windows%"),"Windows",like(Operating_System,"%Linux%"),"Linux",like(Operating_System,"%Missing%"),"Others",like(Operating_System,"%Solaris%"),"Solaris",like(Operating_System,"%AIX%"),"AIX",1=1,"Others")
| eval Environment=case(like(Environment,"%Prod%"),"Prod",like(Environment,"%Production%"),"Prod",1=1,Environment)
| search OS="Windows" AND Environment="PSE" OR Environment="Prod" AND Eligibility="Upper" AND Hardware_Status="Installed"
| eval group="Windows "]|stats count by group

Can this be merged into one single query without using append ? This will help me to not running same sourcetype 2 times.

Labels (1)
0 Karma
1 Solution

renjith_nair
Legend

You can combine using another eval for group.

For e.g

index=A sourcetype=Server
| fillnull value=""
| eval OS=case(like(Operating_System,"%Windows%"),"Windows",like(Operating_System,"%Linux%"),"Linux",like(Operating_System,"%Missing%"),"Others",like(Operating_System,"%Solaris%"),"Solaris",like(Operating_System,"%AIX%"),"AIX",1=1,"Others")
| eval Environment=case(like(Environment,"%Prod%"),"Prod",like(Environment,"%Production%"),"Prod",1=1,Environment)
| search (Environment="PSE" OR Environment="Prod") AND Eligibility="Upper" AND Status="Installed"
| eval group = case(OS="Windows","Windows",OS="Linux" OR OS="Solaris","Unix Server",1=1,"Unknown")
| stats count by group
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

You can combine using another eval for group.

For e.g

index=A sourcetype=Server
| fillnull value=""
| eval OS=case(like(Operating_System,"%Windows%"),"Windows",like(Operating_System,"%Linux%"),"Linux",like(Operating_System,"%Missing%"),"Others",like(Operating_System,"%Solaris%"),"Solaris",like(Operating_System,"%AIX%"),"AIX",1=1,"Others")
| eval Environment=case(like(Environment,"%Prod%"),"Prod",like(Environment,"%Production%"),"Prod",1=1,Environment)
| search (Environment="PSE" OR Environment="Prod") AND Eligibility="Upper" AND Status="Installed"
| eval group = case(OS="Windows","Windows",OS="Linux" OR OS="Solaris","Unix Server",1=1,"Unknown")
| stats count by group
---
What goes around comes around. If it helps, hit it with Karma 🙂

dtccsundar
Path Finder

This Worked !! Thank you .

Tags (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @dtccsundar,

You can create group field using one more case like below;

index=A sourcetype=Server 
| fillnull value="" 
| eval OS=case(like(Operating_System,"%Windows%"),"Windows",like(Operating_System,"%Linux%"),"Linux",like(Operating_System,"%Missing%"),"Others",like(Operating_System,"%Solaris%"),"Solaris",like(Operating_System,"%AIX%"),"AIX",1=1,"Others") 
| eval Environment=case(like(Environment,"%Prod%"),"Prod",like(Environment,"%Production%"),"Prod",1=1,Environment) 
| search OS IN ("Linux","Solaris","Windows") (Environment="PSE" OR Environment="Prod") Eligibility="Upper" (Status="Installed" OR Hardware_Status="Installed") 
| eval group=case((OS="Linux" OR OS="Solaris") AND Status="Installed","Unix Server",(OS="Windows" OR OS="Solaris") AND Hardware_Status="Installed","Windows") 
| stats count by group
If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...