Splunk Search

How do you combine similar Items in a search?

balcv
Contributor

I have a scenario where I have a data set that contains user ids, among other things, but there are two possible versions of the user id that I would like to be able to combine into a single search result.
For example, user id could be d1\123456 and it could be d2\123456. This is the same user just from a different domain.

index="pan" | stats count by user | sort -count

This will result in a separate line for every unique user

d1\123456      45
d2\123456      83

I would like to be able to get a single line for user 123456 irrespective of the domain (d1 or d2).

123456         128

Is this possible?

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index="pan"
| rex field=user mode=sed "s/.*\\\//"
| stats count by user
| sort 0 -count

View solution in original post

woodcock
Esteemed Legend

Like this:

index="pan"
| rex field=user mode=sed "s/.*\\\//"
| stats count by user
| sort 0 -count

balcv
Contributor

@woodcock, thank you, that is exactly what I was after. Simple when you know how.

0 Karma

vnravikumar
Champion

Hi

Try like

| makeresults 
| eval msg="d1\\123456,d2\\123456" 
| makemv delim="," msg 
| rex field=msg "\\\(?P<user>[\d]+)" 
| stats count by user 
| sort -count

balcv
Contributor

Thanks for the response @vnravikumar . What I think I omitted was that the data set will contain hundreds of user ids in the format domain\userid and there could be user ids with just d1, some with just d2 or some with both.

I'm looking for search results showing the unique user ids combining those that have both d1 and d2 while still listing those with just the single domain.

Also, the user id can be both numeric and alpha. (eg some as 123456 others as ajones with the d1 and/or d2 domain).

0 Karma

vnravikumar
Champion

Hi

Try this, if not worked give some sample user ids

| makeresults 
| eval msg="d1\\123456,d2\\123456,ajones,123456" 
| makemv delim="," msg 
| rex field=msg "(\w+\\\){0,1}(?P<user>[\w]+)" 
| stats count by user 
| sort -count
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...