Splunk Search

How to count from raw lines?

ndiphe13
Engager

I have a lot of RAW data with this format:
date_time,serverA,down
date_time,serverB,down
date_time,serverA,down
date_time,serverA,down
date_time,serverA,up
date_time,serverB,up

How to count that raw data so we can have the following result?
server | up | down|
serverA | 1 | 3 |
serverB | 1 | 1 |

Thanks,
Andi

Tags (2)
0 Karma
1 Solution

niketn
Legend

@ndiphe13, following is a run anywhere search based on the sample data and output provided in the question. The commands from | makeresults till | rename data as _raw generate the mock data. You can use your base search instead.

| makeresults
| eval data="date_time,serverA,down;date_time,serverB,down;date_time,serverA,down;date_time,serverA,down;date_time,serverA,up;date_time,serverB,up"
| makemv data delim=";" 
| mvexpand data
| rename data as _raw
| makemv _raw delim=","
| eval server=mvindex(_raw,1),status=mvindex(_raw,2)
| chart count over server by status

PS: Since you already have command delimited data, you can use props.conf to generate the fields server and status during search time. That way you will not require makemv and eval commands

<YourBaseSearch>
| chart count over server by status
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@ndiphe13, following is a run anywhere search based on the sample data and output provided in the question. The commands from | makeresults till | rename data as _raw generate the mock data. You can use your base search instead.

| makeresults
| eval data="date_time,serverA,down;date_time,serverB,down;date_time,serverA,down;date_time,serverA,down;date_time,serverA,up;date_time,serverB,up"
| makemv data delim=";" 
| mvexpand data
| rename data as _raw
| makemv _raw delim=","
| eval server=mvindex(_raw,1),status=mvindex(_raw,2)
| chart count over server by status

PS: Since you already have command delimited data, you can use props.conf to generate the fields server and status during search time. That way you will not require makemv and eval commands

<YourBaseSearch>
| chart count over server by status
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

ndiphe13
Engager

Thanks @niketnilay for your great sharing. Ive done some changes in the props.conf and transform.conf. The output is exactly what I am expected.

props.conf

[syslog]
REPORT-fields=commafields

transform.conf

   [commafields]
    DELIMS = ","
    FIELDS = date_time, server, sensor, status, remark

My Search

  <MyBaseSearch> | chart count over server by status

niketn
Legend

Perfect!!! Way to go. 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...