Splunk Search

How to query where I can display x and y values as the top value?

abhi04
Communicator

I have a tag which has four values i.e. a,b,x,y. But I want to display only the x and y values as the top value. I tried the below query but it is not working.

Source title=webatm* | eval t=if(tag==x OR tag==y)|top t
0 Karma
1 Solution

micahkemp
Champion

Try:

 | eval t=if(tag="x" OR tag="y", tag, NULL)|top t

Inside an if (or other eval function), an un-quoted string represents a field name, and a quoted string represents the string itself.

Or, for multivalue fields, try:

| eval t=mvfilter(match(tag, "x") OR match(tag, "y"))
| top t

View solution in original post

0 Karma

micahkemp
Champion

Try:

 | eval t=if(tag="x" OR tag="y", tag, NULL)|top t

Inside an if (or other eval function), an un-quoted string represents a field name, and a quoted string represents the string itself.

Or, for multivalue fields, try:

| eval t=mvfilter(match(tag, "x") OR match(tag, "y"))
| top t
0 Karma

abhi04
Communicator

Hi micahkemp,

The above query is including all the values a,b,x,y and not x,y only.
It's returning same as below query.
Source type=webatm*|top tag

I want only x and y values.

0 Karma

micahkemp
Champion

It doesn't when I run it:

| makeresults count=6| eval tag="x"
| append [| makeresults count=10 | eval tag="y"]
| append [| makeresults count=20 | eval tag="z"]
| eval t=if(tag="x" OR tag="y", tag, NULL)|top t

Is your tag value a multivalue field, perhaps, where one event has multiple values for tag? If that is the case try this instead:

| eval t=mvfilter(match(tag, "x") OR match(tag, "y"))
|top t
0 Karma

abhi04
Communicator

Thanks Micahkemp.

It was anmultivalue field and the mvfilter is working.
Appreciated your help.Thanks a ton

0 Karma

micahkemp
Champion

Great! I've added the mvfilter version to my answer. If that answer solves your issue, please accept it so the question no longer appears open, and others have an easier time finding the answer.

0 Karma

abhi04
Communicator

It still shows the percentage among all the values i.e. a,b,x,y and not between x and y only.

The above query result shows the same as below query

Source type=webatm* |top tag

But this is including all a,b,x and y values which I don't want.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...