Splunk Search

Grouping similar

brywilk_umich
Path Finder

HI All,

Im have a search and its working great for calculating averages based on the domain, the problem is that I would like to group the google.com's together. I thought I could do it with the eval command but it doesnt seem to be working for me

search
index=collaboration tag::host=inbound [search index=collaboration tag::host=inbound mail_sender=email_address@umich.edu | fields simta_id] | transaction simta_id | stats avg(duration) as "Average Duration" by domain_name

output looks like this

adsroot.itcs.umich.edu  31.538462
med.umich.edu   35.000000
mail-ig0-f173.google.com    61.000000
mail-ig0-f175.google.com    36.000000
mail-oi0-f47.google.com 36.000000
mail-qa0-f44.google.com 36.000000
mail-vc0-f178.google.com    36.000000
mail-wg0-f49.google.com 36.000000
mail-wi0-f178.google.com    37.000000
mail-yh0-f51.google.com 34.000000
mail-yk0-f170.google.com    36.000000

thanks all

Tags (1)
0 Karma

chanfoli
Builder

If the full hostname does not matter for google.com you could do something like the following to reassign just google.com:

index=collaboration tag::host=inbound [search index=collaboration tag::host=inbound mail_sender=email_address@umich.edu | fields simta_id] | transaction simta_id |eval domain_name=if(match(domain_name,".*google.com"),"google.com",domain_name)| stats avg(duration) as "Average Duration" by domain_name

somesoni2
SplunkTrust
SplunkTrust

Another alternative

index=collaboration tag::host=inbound [search index=collaboration tag::host=inbound mail_sender=email_address@umich.edu | fields simta_id] | transaction simta_id | replace *.google.com with google.com in domain_name| stats avg(duration) as "Average Duration" by domain_name 

acharlieh
Influencer

By "group the google.com's" together, do you mean you want 1 average for all *.google.com domain_names ? Do you want the umich.edu domain_names grouped as well?

0 Karma

brywilk_umich
Path Finder

Hi,

Sorry about that only the Google ones should be groups the umich ones are fine separate

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Will there be other domains like "google.com" which may appear multiple time? Also, the first two entries in your output, should they be also clubbed into one? (they both are from umich.edu domain)

0 Karma

brywilk_umich
Path Finder

Hi,

Sorry about that only the Google ones should be groups the umich ones are fine separate

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...