Reporting

use partial data from a field in reports

bhartmann
New Member

Hi,

We have a version field with 4 numbers, for instance 2018.1.0.1234 (major.minor.patch.build)

One report will need the full version number, but we also want a chart which essentially throws away patch.build (leaving just values such as 2018.0, 2018.1, etc.). Of course we could send the data with a second key to get the shorter values, but I assume there are better ways so we can keep our data throughput down.

Would appreciate help with example(s) of how to achieve this.

Thanks!

0 Karma
1 Solution

adonio
Ultra Champion

hello there,

many ways to go about this one, here is a sample using the | rex command to create 4 fields as you asked above.
run this search anywhere to check:

    | makeresults count=1 
    | eval version="2018.1.0.1234,2018.2.0.1234,2018.1.2.1234,2018.1.0.1235"
    | makemv delim="," version
    | mvexpand version
    | rex field=version "(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)\.(?<build>\d+)"

from here you can go many ways, for example"
| eval major_minor = major.".".minor

hope it helps

View solution in original post

adonio
Ultra Champion

hello there,

many ways to go about this one, here is a sample using the | rex command to create 4 fields as you asked above.
run this search anywhere to check:

    | makeresults count=1 
    | eval version="2018.1.0.1234,2018.2.0.1234,2018.1.2.1234,2018.1.0.1235"
    | makemv delim="," version
    | mvexpand version
    | rex field=version "(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)\.(?<build>\d+)"

from here you can go many ways, for example"
| eval major_minor = major.".".minor

hope it helps

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...