Getting Data In

Interactive Field Extraction

Splunk_User792
New Member

2012-06-21 23:58:57,200 [M3P3] DEBUG - LOG|2012-06-21|23:58:57|4|9|AB123C|MCL|88|1234|123456|12345|N|N|AAAA 1234567||||||||||AAAA 1234567|AAAA 1234567||5|||||||||YES|A|AA$BBB|Y|123|

I want to extract field like Auto = with values YES and NO
When I extract field from left of the timestamp of the results of the search, I get the result as below
FIELD NAME ---- COUNT
YES --------------- 2054
NO ---------------- 21

But my total result is 2320 and count of YES should be 2054 (which is correct) and count of NO should be 266 according to the count result done by searching manually from search bar.
Why do I get incorrect count of NO?
I want to create pie chart of YES and NO counts. For that, I think I must have this information correct right?
Please Help me..
Thank you very much..

Tags (1)
0 Karma
1 Solution

rturk
Builder

You may have other instances of "YES" or "NO" in other fields which could be skewing your results. The key here is making sure your field extractions are correct.

You have a pipe-delimited filed, with the 36th field being the value you're interested in. Not sure whether you're interested in the other fields, but here goes.

props.conf

[yoursourcetype]
pulldown_type = false
KV_MODE = false
SHOULD_LINEMERGE = false
REPORT-fields = yoursourcetype_fields

transforms.conf

[yoursourcetype_fields]
DELIMS = "|"
FIELDS = "header", "date", "time", "field_4", ... , "field_35", "yes_no"

Splunk Search

sourcetype=yoursourcetype | stats count by yes_no

There is no doubt a more elegant way of doing this by regular expressions, my regex-fu is weak 😛

Hope this helps!

View solution in original post

rturk
Builder

You may have other instances of "YES" or "NO" in other fields which could be skewing your results. The key here is making sure your field extractions are correct.

You have a pipe-delimited filed, with the 36th field being the value you're interested in. Not sure whether you're interested in the other fields, but here goes.

props.conf

[yoursourcetype]
pulldown_type = false
KV_MODE = false
SHOULD_LINEMERGE = false
REPORT-fields = yoursourcetype_fields

transforms.conf

[yoursourcetype_fields]
DELIMS = "|"
FIELDS = "header", "date", "time", "field_4", ... , "field_35", "yes_no"

Splunk Search

sourcetype=yoursourcetype | stats count by yes_no

There is no doubt a more elegant way of doing this by regular expressions, my regex-fu is weak 😛

Hope this helps!

Splunk_User792
New Member

WOW, THANK YOU SO MUCH!!!! V^-^V

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...