Splunk Search

How to group by a by Title?

mogoj
Engager

Hi guys!!
I have this search:

    index=temp sourcetype=sdc cs_host="*mto.ree.*" WT_dl=0 NOT (cs_uri_stem ="*/es-es/paginas/inicio.aspx" OR cs_uri_stem =*/results.aspx* OR cs_uri_stem =*/_layouts/*  OR cs_uri_stem =*/_catalogs/* OR cs_uri_stem =/personal* ) 
    | fillnull value="Sin Título" WT_ti
    | top limit=0 WT_ti, cs_uri_stem,WT_device  
    | eval WT_ti= urldecode(WT_ti)
    | eval percent = round(percent,2) 
    | eval Escritorio= if(WT_device=="Escritorio",count,0)
    | eval iPhone= if(WT_device=="IPhone",count,0)  
    | eval iPad= if(WT_device=="IPad",count,0)  
    | eval Otros= if(WT_device=="Linux",count,0) 
    | eval WT_ti = if (WT_ti== "Mi perfil - Noticias", "Mi perfil - Novedades",WT_ti )  
    | rename WT_ti as Titulo,cs_uri_stem as URL, count as "Paginas_Vista", percent as "Porcentaje_%"
    | search Titulo=Comunidades

Attach an image of results, my problem, I need not show de Column WT_device and show the results in a single line. It's possible?
Thanks for you time!!

0 Karma
1 Solution

TISKAR
Builder

@mogoj , Can you add this please:

| stats sum(*)  as * by Titulo URL

Search compet:

 index=temp sourcetype=sdc cs_host="*mto.ree.*" WT_dl=0 NOT (cs_uri_stem ="*/es-es/paginas/inicio.aspx" OR cs_uri_stem =*/results.aspx* OR cs_uri_stem =*/_layouts/*  OR cs_uri_stem =*/_catalogs/* OR cs_uri_stem =/personal* ) 
 | fillnull value="Sin Título" WT_ti
 | top limit=0 WT_ti, cs_uri_stem,WT_device  
 | eval WT_ti= urldecode(WT_ti)
 | eval percent = round(percent,2) 
 | eval Escritorio= if(WT_device=="Escritorio",count,0)
 | eval iPhone= if(WT_device=="IPhone",count,0)  
 | eval iPad= if(WT_device=="IPad",count,0)  
 | eval Otros= if(WT_device=="Linux",count,0) 
 | eval WT_ti = if (WT_ti== "Mi perfil - Noticias", "Mi perfil - Novedades",WT_ti )  
 | rename WT_ti as Titulo,cs_uri_stem as URL, count as "Paginas_Vista", percent as "Porcentaje_%"
 | search Titulo=Comunidades
 | stats sum(*) as * by Titulo URL

View solution in original post

TISKAR
Builder

@mogoj , Can you add this please:

| stats sum(*)  as * by Titulo URL

Search compet:

 index=temp sourcetype=sdc cs_host="*mto.ree.*" WT_dl=0 NOT (cs_uri_stem ="*/es-es/paginas/inicio.aspx" OR cs_uri_stem =*/results.aspx* OR cs_uri_stem =*/_layouts/*  OR cs_uri_stem =*/_catalogs/* OR cs_uri_stem =/personal* ) 
 | fillnull value="Sin Título" WT_ti
 | top limit=0 WT_ti, cs_uri_stem,WT_device  
 | eval WT_ti= urldecode(WT_ti)
 | eval percent = round(percent,2) 
 | eval Escritorio= if(WT_device=="Escritorio",count,0)
 | eval iPhone= if(WT_device=="IPhone",count,0)  
 | eval iPad= if(WT_device=="IPad",count,0)  
 | eval Otros= if(WT_device=="Linux",count,0) 
 | eval WT_ti = if (WT_ti== "Mi perfil - Noticias", "Mi perfil - Novedades",WT_ti )  
 | rename WT_ti as Titulo,cs_uri_stem as URL, count as "Paginas_Vista", percent as "Porcentaje_%"
 | search Titulo=Comunidades
 | stats sum(*) as * by Titulo URL

mogoj
Engager

Thanks!!!!

0 Karma

FrankVl
Ultra Champion

Can you perhaps sketch the desired result (e.g. in excel or so)? I don't entirely follow what you are looking for.

0 Karma

mogoj
Engager

Hi Frank,
I have this-->
Titulo URL WT_device Paginas Vista Porcertanje Escritorio Otros Ipad iPhone
Comunidades Paginas/default.aspx Escritorio 28 8,02 28 0 0 0
Comunidades Paginas/default.aspx iPhone 2 0,57 0 0 0 2
Comunidades Paginas/default.aspx iPad 2 0,57 0 0 2 0

And i Like this-->
Titulo URL Paginas Vista Porcentaje Escritorio Otros Ipad iPhone
Comunidades Paginas/default.aspx 32 9,16 28 0 2 2

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...