Splunk Search

Using regex with timechart

sarahw3
Explorer

I want to create a timechart based on 5 tags. I have tried | timechart count by tag |regex tag="Working|No_Images|Other|Never_Checked|Camera_Not_Working" and it does not work. If I get rid of the regex, it generates the timechart but it has all the tags (70+) in the chart when I only want 5. Is there another way I can make the timechart just show the 5 tags?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi sarahw3,
probably your events have more than one tag for each, you could use eval to choose only the needed five, the problem is that if an event has more than one of the five tags, it takes only the first.
try something like this

your_search
| eval event=case(tag="tag1","tag1",tag="tag2","tag2",tag="tag3","tag3",tag="tag4","tag4",tag="tag5","tag5")
| search tag=tag1 OR tag=tag2 OR tag=tag3 OR tag=tag4 OR tag=tag5
| timechart count by tag

Bye.
Giuseppe

View solution in original post

0 Karma

3no
Communicator

The easy way, will be to filter on the tags before the timechart (this will also be more efficient) :

index=foo (tag=Working OR tag=No_Images OR tag=Other OR tag=Never_Checked OR tag=Camera_Not_Working) | timechart count by tag

gcusello
SplunkTrust
SplunkTrust

Hi sarahw3,
probably your events have more than one tag for each, you could use eval to choose only the needed five, the problem is that if an event has more than one of the five tags, it takes only the first.
try something like this

your_search
| eval event=case(tag="tag1","tag1",tag="tag2","tag2",tag="tag3","tag3",tag="tag4","tag4",tag="tag5","tag5")
| search tag=tag1 OR tag=tag2 OR tag=tag3 OR tag=tag4 OR tag=tag5
| timechart count by tag

Bye.
Giuseppe

0 Karma

sarahw3
Explorer

Thank you so much!! That worked perfectly!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...