Splunk Search

How to group search results based on values?

Javo222
Path Finder

I need to filter some search results. Today I have the following search:

search index="test" series_name=* | stats count(series_name) AS "#" by series_name | rename series_name AS "series"

and it returns the following:

A10 > 8
T35 > 10
D22 > 2
211 > 4
H20 > 9
240 > 6
213 > 16

And would like to group the results starting with 2xx:

A10 > 8
T35 > 10
D22 > 2
2xx > 26
H20 > 9

Didn't find a way to do so.

0 Karma

sideview
SplunkTrust
SplunkTrust

search index="test" series_name=2* | rename series_name AS series| stats count AS "#" by series

I also changed your stats count(series) by series to just stats count by series because the whole count(foo) by foo thing is redundant and a little weird. Normally when you see count(foo) in someone's search it's being a little misused and can be simplified in this way.

count(foo) is often used where count would suffice. And it's also sometimes even misinterpreted as "count the distinct values of foo", although of course that's distinct_count(foo) or more commonly, dc(foo).

What count(foo) does in english is "count the number of incoming rows that have any non-null value for the foo field". Now returning to stats count(foo) by foo you'll see that it's a little nonsensical and always will be the same as count by foo. Might as well save yourself the typing and save someone else down the road the potential misunderstanding.

somesoni2
SplunkTrust
SplunkTrust

Try something like this

index="test" series_name=* | stats count(series_name) AS count by series_name | eval series=if(like(series_name,"2%"),"2XX",series_name) | stats sum(count) as "#" by series
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...