Splunk Search

Group By Replace

jasonhask
Explorer

Hello,

I have several things that come in via different platforms: Android (watch, phone, tablet), iOS (Watch, Phone, Tablet), and Web. For counting purposes I just need to know the platform (for now). I was wondering if there was any way possible to group my counts by my replaces.

index =blah source=blah earliest=-16m@m latest=-1m@m 
| stats count(eval(Status=0 OR Status=1)) as Now by Platform
| replace android* with Android, *Web* with Web, ip* with iOS
| table Platform, Now

As of now my results look like:

Platform            Now
android              96
android               1
android            1306
iOS                3000
iOS                  45
iOS                   2
Web                1286
Web                 956

What I would like:

Platform            Now
Android            1403
iOS                3047
Web                2242

Thanks in advance for any help.

0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

index =blah source=blah earliest=-16m@m latest=-1m@m 
| stats count(eval(Status=0 OR Status=1)) AS Now BY Platform
| replace android* with Android, *Web* with Web, ip* with iOS
| stats sum(Now) AS Now BY Platform

View solution in original post

woodcock
Esteemed Legend

Try this:

index =blah source=blah earliest=-16m@m latest=-1m@m 
| stats count(eval(Status=0 OR Status=1)) AS Now BY Platform
| replace android* with Android, *Web* with Web, ip* with iOS
| stats sum(Now) AS Now BY Platform

jasonhask
Explorer

While that didn't answer my question directly it led me in the right direction, thank you!

0 Karma

woodcock
Esteemed Legend

OK, then do click Accept on the answer to close the question.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...