Splunk Search

Combine two fields values in 1 value

NewMilenium
Path Finder

Hello,
I searched for hours without any working result, sorry.
Somes searches I'm running give out results, with a field named "service" with some results, and two of those results are "HTTP" and "http". I must do something them so that they are both "HTTP", the same value.
One of the searches, for example, is of that form :

index="nnn" service="*" | stats count(service) by service | sort 10 -num(count(service))

Some of the results it can return are like that :

    service     count(service)
1   HTTP        492234
2   http        219422
3   SNMP        188368
4   DNS         152919

Can anyone help me, please? Thanks a lot for any clue!

Tags (2)
0 Karma
1 Solution

rturk
Builder

Hi NewMillenium,

Try the following:

index="nnn" service="*" 
| eval service=upper(service) 
| stats count(service) AS count BY service 
| sort -count

Let me know how you go 🙂

References:

View solution in original post

rturk
Builder

Hi NewMillenium,

Try the following:

index="nnn" service="*" 
| eval service=upper(service) 
| stats count(service) AS count BY service 
| sort -count

Let me know how you go 🙂

References:

rturk
Builder

Yep, that's exactly it 🙂 Happy Splunking!

0 Karma

NewMilenium
Path Finder

Oh, it works!
If I get it right: this is permitting to change ALL services into their uppercase writing, and so resolving my problems, and you're just having "count(service)" as "count" so you don't have to rewrite "count(service)" in the sort...?

Thanks a lot for your help!!
(one "L" only to my nickname - no offense, I say it to absolutely everybody 😛 )

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...