Splunk Search

How to include a field in a count if it has some particular text?

hastrike
New Member

I have pulled a list of all the Operating systems in the environment. Although, they are all server 2008, for example, some are standard, enterprise, datacenter, etc.... Did a stats count to get a count of the number of each operating system in the environment. However, I would like to combine the stats count results for anything that is just Server 2008, 2012, or XP. How can I combine these results into one entry for Server 2008 and then one for server 2012? The count values would then combine as well.

In Excel I know I can do a count If (COLUMN, "*2008*") and it will count anything that has 2008 in the OS column. Is there anything like that in Splunk?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try something like this

your current search with stats giving fields osType and count | eval osType=case(like(osType,"%2008%"),"Win Server 2008",like(osType,"%2012%"),"Win Server 2008",1=1."Windows XP") | stats sum(count) as count by osType

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this

your current search with stats giving fields osType and count | eval osType=case(like(osType,"%2008%"),"Win Server 2008",like(osType,"%2012%"),"Win Server 2008",1=1."Windows XP") | stats sum(count) as count by osType
0 Karma

hastrike
New Member

Thank you for the input

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...