Splunk Search

Combining Multivalues together inside a field

watsm10
Communicator

I've got a field named "User" which holds the names of all the users of our service. Some users have similar names and I'd like to group them together in search outputs.

I'm creating a search to output the number of transactions by user.

source=index | chart count by User | rename count as "Transaction Count"


User | Transaction Count
ABC | 100
DEF | 300
GHI | 400
TEST | 5
TEST1 | 10
TEST12 | 20
TEST123 | 200
JKL | 300
MNO | 200

I'd like to group everything with "TEST" in the name together (they are the all the same user, but under similar userIDs), along with adding the values for each instance of "TEST" to create a new multivalue called "TEST" (see below).


User | Transaction Count
ABC | 100
DEF | 300
GHI | 400
TEST | 235
JKL | 300
MNO | 200

Can anybody help me? Thanks.

1 Solution

cphair
Builder

If you don't care about keeping all the test accounts separate, I would use rex to rename them at search time. Something like this should work:


| rex field=User mode=sed "s/(TEST).*/\1/" | chart count by User

This assumes that no legitimate user account will have the word TEST in it, so depending on your data you may have to tweak the regex a bit.

View solution in original post

cphair
Builder

If you don't care about keeping all the test accounts separate, I would use rex to rename them at search time. Something like this should work:


| rex field=User mode=sed "s/(TEST).*/\1/" | chart count by User

This assumes that no legitimate user account will have the word TEST in it, so depending on your data you may have to tweak the regex a bit.

watsm10
Communicator

Thankyou so much!! 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...